Field Service Mobile Security

The Field Service App is built with the Salesforce Mobile SDK. The Salesforce Mobile SDK provides a set of low-level services that include security and authentication to applications that are built using this framework.

For information about data protection regulations and Agentforce Service (formerly Service Cloud), see Data Protection and Privacy.

Local Encryption at Rest

Encryption boosts the security of your customers’ data and helps you comply with privacy policies, regulatory requirements, and contractual obligations. Shield Platform Encryption and Field Audit Trail are supported for the following fields on work orders, work order line items, and service appointments:

• Description
• Subject
• Address (Street and City only)

To encrypt these fields, add them to your Encryption Policy in Setup. The Subject and Address fields support both probabilistic and deterministic encryption, while the Description field supports only probabilistic encryption. If Field Audit Trail is enabled, you can set field history data retention policies for the fields whose data you want to retain.

Note

• Encryption is not supported for the Latitude and Longitude fields, which could be used to pinpoint an address.
• When you encrypt a field, existing values aren’t encrypted. Contact Salesforce for help with encrypting existing data.

Server-Side Encryption at Rest

Salesforce provides encryption abilities for data at rest on the Salesforce servers. The Platform Encryption feature allows customers to create policies at the field-level to encrypt sensitive data. This feature supports custom objects, and a subset of standard fields on standard objects. As of the time of this writing, encryption is supported for some fields on the following standard objects: Account, Contact, Opportunity, Lead, Case, and Case Comment.

Custom fields on these or other objects can be encrypted assuming that they use data types that can be encrypted.

Encrypting Data in Transit

Data transmitted to and from the Salesforce server is protected using SSL. Authentication, access controls, and digital signatures are protected using SHA-256.

Trusted IP Ranges

Logins to the Field Service mobile app can be restricted to specific trusted IP ranges, which is also true for the Salesforce mobile app. You can implement this using a Virtual Private Network (VPN) solution on mobile devices. After logging in to VPN, users can log in to the app. Afterwards, the user can log in to Salesforce.

Device Identification

Salesforce is piloting a new feature to track device fingerprints accessing the Salesforce services. The feature supports the ability to see who logged in with a particular device and to revoke access to specific devices.

Handling Sensitive Data

To prevent leakage of sensitive data, Salesforce apps support four settings to limit data exfiltration on a mobile device.

• DISABLE_EXTERNAL_PASTE : Allows users to copy-and-paste data within the app, but prevents users from pasting data copied from the app to other apps or OS features.
  

  Note This feature does not work on Samsung phones (and other manufacturers of Android phones) where a custom clipboard implementation is used or on any screens that show Lightning web components.
• FORCE_EMAIL_CLIENT_TO : If a user taps on an email action within the app, the user is directed to the email app specified in the attribute value.
• SHOW_OPEN_IN : Prevents users from opening files in applications outside of the app.
• SHOW_PRINT : Used to disable printing from within the app.

The following table shows the level of support for these features in the Field Service mobile app as well as the Salesforce mobile app.

The Field Service Mobile app settings are non-restrictive by default. To change a setting from the default value, go to Setup. Enter Connected Apps in the Quick Find box, select Manage Connected Apps, then click the name of the Field Service connected app. Update the attribute from the Custom Attributes section on the connected app page.

Mobile Device Management

Salesforce provides an extra level of security compliance with the most popular Mobile Device Management (MDM) suites. Both Android and iOS, with an MDM, give you enhanced functionality for distribution and control over your users’ devices. The enhanced security functions, when you combine Salesforce with an MDM, include certificate-based authentication and automatic custom host provisioning.