You are here:
Encryption
Enable Encrypted Data Sending (EDS) permissions in Marketing Cloud Engagement to identify encrypted fields from Sales or Service Cloud using Classic or Platform Encryption. Re-encrypt those fields in Engagement. Marketing Cloud Connect supports these encryption methods.
- Classic Encryption
- Shield Platform Encryption
- Field-Level Encryption
Combine Classic or Shield Platform Encryption in Sales or Service Cloud with Encrypted Data Sending in Engagement for cross-cloud data encryption.
| Encryption requirement | Applicable product |
|---|---|
| Encrypt specific fields in Engagement with granularity by data extension | Field-Level Encryption |
| Encrypt custom text fields in Sales or Service Clouds | Classic Encryption |
| Encrypt certain fields on the Account, Contact, Case, and Case Comment objects in Sales or Service Clouds | Shield Platform Encryption |
Encrypted Sales or Service Cloud Data in Engagement
Sales or Service Cloud encrypted data appears as either unencrypted text or as asterisks in Engagement. The data appearance depends on the permissions of the user who completes the send through Marketing Cloud Connect. Engagement stores encrypted data in the same format that the running user sees in Sales or Service Cloud.
For example, User A has the View Encrypted Data permission in Sales Cloud, but User B doesn’t. Both people are Marketing Cloud Connect users. In Sales or Service Cloud, User A sees the encrypted data, but User B sees masked values, or asterisks, for that data.
If User A sends to a report containing encrypted data, Engagement stores that encrypted data as regular text. If User B sends to that same report, Engagement stores that encrypted data as asterisks.
Field-Level Encryption
Using Synchronized Data Sources, enable Field-Level Encryption permissions in Engagement to identify encrypted fields from Sales or Service Cloud. Then re-encrypt those fields in Engagement. Use this synchronized data in messages sent through Engagement.
Synchronized Data Sources doesn’t support Shield-encrypted dates or datetimes.
Considerations
- Engagement always encrypts the email address field when sending from the Sales and Service Cloud with Field-Level Encryption enabled. This encryption occurs regardless of whether the Sales or Service Cloud encrypts that field or if you don’t enable Shield Platform or Classic Encryption.
- Engagement denotes email addresses as read-only in the All Subscribers list and profile center when Field-Level Encryption is enabled. To allow subscribers to update their email address with EDS enabled, map a new profile attribute to the Lead and Contact email address. Include the attribute in the profile center.
