Root Key Wrapping

Some of the Shield Platform Encryption features, like Search Index Encryption, make use of a customer controlled root key for DEK wrapping.

Root keys are stored on either a Salesforce controlled KMS, or on a supported external KMS chosen by the customer. The KMS uses the root key to wrap the data encryption key during transport. Shield Platform Encryption calls out to the appropriate KMS to request that a key be wrapped for storage or unwrapped for use.