We have a field Contact.Email which cannot be encrypted due to existing org customisation and a number of installed managed packages.
Our requirement is for the email field to be encrypted at Rest for a specific integrations only.
This field will be referenced in:
- (1) an integration payload generated in Apex and sent to an external endpoint
- (2) included in a platform event field published from an external system - for this I was able to enable "Encrypt change data capture events and platform events"
What is not clear to me is does Shield "encryption at rest" mean that anything transmitted via the REST Api is encrypted OR do individual fields need to be encrypted still in order to be encrypted at REST?
Any data travelling outside Salesforce via any API is going to be using HTTPS which means it is encrypted in transit. Encryption at rest means that the data in the database is encrypted (Platform Encryption).
These are two very different things. When you say "Our requirement is for the email field to be encrypted at Rest for a specific integrations only." I believe you are confusing the two.
The email address will be sent in plain text (so the other side can just read it) down an encrypted pipe when using HTTPS which Salesforce mandates for all transactions. If you did not have HTTPS, you would need to encrypt the field with something and then send it to the other side which would need to decrypt it. This is not needed with HTTPS as the entire conversation is encrypted by the network layer.
