Sync Data with Self-Service Background Encryption
Synchronizing your data with your active key material keeps your encryption policy up to date. You can sync data in standard and custom fields, the Attachment—Content Body field, and for field history and feed tracking changes from the Encryption Statistics and Data Sync page in Setup. To synchronize all other encrypted data, contact Salesforce Customer Support.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
| Available in: Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses. |
| Available for free in Developer Edition. |
| User Permissions Needed | |
|---|---|
| View Platform Encryption Setup pages: | View Setup and Configuration |
Self-service background encryption supports all standard and custom fields, the Attachment—Content Body field, and field history and feed tracking changes. For help synchronizing all other encrypted data, contact Salesforce Customer Support.
Plan to sync data as soon as possible after rotating a deterministic encryption key. Also sync data to your active key immediately after adding, removing, or changing the deterministic encryption scheme on a field. When planning a sync, It is better to run the sync during off peak hours if you have high volumes, or if you expect high traffic when you make changes to your encryption settings.
To include field history and feed tracking values in self-service background encryption processes, first turn on Encrypt Field History and Feed Tracking Values on the Encryption Settings page. You can also enable field history and feed tracking encryption programmatically with the PlatformEncryptionSettings metadata type. When this setting is turned on, the self-service background encryption process applies your active key material to your field history and feed tracking values.
- From Setup, in the Quick Find box, enter Platform Encryption, and then select Encryption Statistics.
-
Select an object type or custom object from the left pane.
Note The Sync Needed column indicates when to synchronize your data. This column displays Yes when you add or remove encryption on fields, rotate keys, or change a field’s encryption scheme.
-
Click Sync.
Supported standard and custom fields are encrypted with your active key material and encryption policy in the background. After the service syncs your data, it gathers statistics for the object. To view your gathered statistics, wait for your verification email and then refresh the Encryption Statistics and Data Sync page.
The sync process time varies depending on how much data you have in your object. You get an email notification when the sync process finishes. You can sync your data from the Encryption Statistics and Data Sync page once every 7 days.
If you have lots of data in Attachment—Content Body fields, the sync process breaks your request into batches and syncs them in sequence. However, sometimes we can’t encrypt all these batches at once. This service protection helps Salesforce maintain functional network loads. If the sync process finishes but the encryption statistics status is less than 100% complete, click Sync again. The background encryption service picks up where it left off.
