Differences Between FLE and Database Encryption
While Database Encryption supports most Salesforce features, there are some differences in what it supports and what FLE supports.
Required Editions
| Available in both Lightning Experience and Salesforce Classic (not available in all orgs). |
| Available in: Enterprise, Performance, Unlimited and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption. |
This table compares the supported and unsupported features for FLE and Database Encryption. Refer also to Which Salesforce Apps Don’t Support Shield Platform Encryption?.
| Feature | App Tier (FLE) | Database Tier (Database Encryption. |
|---|---|---|
| Salesforce Editions | Available as an add-on subscription in: Enterprise, Performance, and Unlimited Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption. | Available as an add-on subscription in: Enterprise, Performance, and Unlimited Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption. |
| Requires Hyperforce | No | Yes |
| Encryption Algorithm | 256-bit Advanced Encryption Standard (AES) | 256-bit Advanced Encryption Standard (AES) |
| Salesforce Key | Yes | Yes |
| BYOK (Bring Your Own Key) | Yes | Yes |
| Cache-Only Keys | Yes | No |
| EKM (External Key Management) | Yes | No |
| Key Rotation | Customers can synchronize FLE data from the Encryption Statistics page in Setup | Salesforce automatically synchronizes data to the latest key over time |
| Filtering and Queries | Limited if using deterministic encryption | Yes* |
| Sorting | No | Yes* |
| Search | Partial search, lookups, and certain SOSL queries | Yes* |
| Field Limits | Some limits for non-ASCII values | Yes* |
| What You Can Encrypt | Standard and custom fields | Full transactional database |
Note *When FLE is in use in addition to Database Encryption. Standard Shield
Platform Encryption limitations apply.
Did this article solve your issue?
Let us know so we can improve!
