Loading
Prepare for Email to Become the Default Login ExperienceRead More
Set Up and Maintain Your Salesforce Organization
Learn About Encrypting Archived Data

You are here:

  1. Salesforce Help
  2. Docs
  3. Set Up and Maintain Your Salesforce Organization

Learn About Encrypting Archived Data

Data in production is encrypted by a variety of keys, some of which you control via Shield Platform Encryption. When you move data out of production and into an archive, Salesforce encrypts it with a data encryption key (DEK) that you can pair with a root key via Shield Platform Encryption. You control your root key, which means you maintain control of all keys that encrypt data while it’s in the archive.

Required Editions

Available in both Lightning Experience and Salesforce Classic (not available in all orgs).
Available in: Enterprise, Performance, Unlimited, and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption and the Archive add-on license in Hyperforce.

Encryption for Archive uses a two-tier key architecture. You control your Archive root key with Platform Encryption, which Salesforce uses in turn to protect the data encryption keys (DEKs) that encrypt and decrypt data in your archive. When you turn on encryption for Archive in Setup or via the API, Salesforce generates an initial root key for you. It’s applied to all of your archived data.

After that first root key is created, you can opt to use Bring Your Own Key (BYOK) or the Shield External Key Management (EKM) to generate root keys outside Salesforce. To bring your own key, generate a root key and then upload it. When you have data residency or other requirements that dictate that keys be stored outside of Salesforce, generate and store your root key in an AWS KMS key store. Then connect your root key to Salesforce via Shield EKM.

Regardless of how you generate or store root keys, review and audit all of your root keys on the Key Management page in Setup.

Note
Note Archive root keys encrypt archived types in the native Archive app. Root keys don’t encrypt data archives made with the Own from Salesforce Archive managed package or legacy Salesforce Archive.
 
Loading
Salesforce Help | Article