Onboard BYOK
Switch from Salesforce-generated keys to Bring Your Own Key (BYOK) for Shield Platform Encryption.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
| Available in: Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses. |
| Available for free in Developer Edition. |
Implementing Salesforce BYOK involves
- You generate your own key material (either a tenant secret or a data encryption key) outside of Salesforce.
- You use Salesforce to generate a BYOK-compatible RSA certificate (a public/private key pair).
- You "wrap" or encrypt your self-generated key material using the public key from the Salesforce-generated certificate. This secures the tenant secret for transfer.
- You securely upload this wrapped key material to your Salesforce org.
- Salesforce's Key Management Service (KMS) stores your wrapped key material.
This process ensures that Salesforce never directly accesses your plaintext key material, and you maintain control over its generation and lifecycle. Salesforce handles the secure application of the derived DEK for data encryption and decryption.
Prepare to use BYOK
Setting up BYOK requires creating a random secret, and wrapping it with a new certificate. To prepare for BYOK we recommend these steps.
- Read Why Bring Your Own Key?, and the section Bring Your Own Key Overview.
- Read Work with Salesforce Key Material to learn about key rotation.
- Pay special attention about backing up your key material. Salesforce can't assist you if you have destroyed your key and have no backups.
Also, we have provided helper scripts (available for MacOs and Linux) that assist you in creating your wrapped key material. The documentation includes full information on how to use them.
Rotating To and From a BYOK
You can rotate to a BYOK, and rotate back to a Salesforce tenant secret or to EKM (if the feature supports EKM). To the Shield Platform Encryption process, it's just another secret. The topic Work with Salesforce Key Material describes key rotation concepts, considerations, and limitations.
