Skip to main content
トピック#Deterministic Encryption

#Deterministic Encryption0 人がディスカッション中

質問する...
Khushbu Patel が「#Shield/Platform Encryption」で投稿
2025年11月27日 7:31

Hi all

My company has decided to enable encryption, but the process is a bit confusing for me since I haven’t done this before. Has anyone enabled both database-level and field-level encryption? Do we have to enable both? How do you manage your keys and handle backups?

I’m especially concerned about key management — whether it’s better to use the Salesforce-managed keys or go with BYOK. How do you handle key rotation and key backups?

#Shield/Platform Encryption #Encryption Key #Field Level Encryption #Shield Encryption #Encryption Discussion #Shield Platform Encryption #Encrypted #Deterministic Encryption #Platform Encryption
コメントを記入...
0/9000
Andrew Yoder が「Salesforce DX」で投稿
2019年11月27日 15:15

Hi All,

 

Has anyone run into an issue with enabling Deterministic Encryption either via the scratch org definition file or deploying the PlatformEncryption.settings metadata?  While the other encryption settings seem to be working, enableDeterministicEncryption isn't reflecting on the UI when I go to Setup -> Platform Encryption -> Advanced Settings.

 

Based on this article, it seems like it should be possible to do this programmatically.  I have confirmed the user I'm uploading the settings with has the Customize Application and Manage Keys permissions.

https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_pe_deterministic_encrypt.htm

 

Any suggestions would be greatly appreciated.  Thanks!

1 件のコメント
  1. Andrew Yoder
    2019年11月27日 15:21
    One point to add, when I retrieve the PlatformEncryptionSettings metadata, it indicates that deterministic encryption is already enabled, however it will not allow me to generate the "Salesforce Data (Deterministic)" tenant secret until I manually enable it via the UI.
コメントを記入...
0/9000
Nick Spencer が「* Release Readiness Trailblazers *」で投稿
2018年2月8日 14:23

Hi.

Quick Shield question.  If we switch to Deterministic Encryption, will the duplication management tools work (matching rules)?

2 件のコメント
  1. Nicholas Spencer (Cognizant)
    2018年7月29日 8:08

    Hi Zen.

    My guess is that the database has not re-encrypted existing records that have not been accessed or amended. Might be worth checking with Salesforce support to see if they can force all existing records to re-encrypt on deterministic encryption.

コメントを記入...
0/9000
Laurie Hanlon (Validity Inc. の Product Manager)
2018年7月6日 16:36

Hi,

 

I have activated deterministic encryption and am testing the "filtering" capabilities.  This is in a brand new dev org, so no previous encryption was enabled.

 

I know only = and != (equals and not equals) will work, and that text filtering is case sensitive, but it seems that it DOES NOT work with existing values.  For example, I have enabled deterministic encryption on the Lead Email field.  If I try and do an export, I can now see the "email" as a field to base my condition on (that is not the case when using probabilistic encryption), but when I use = email@email.com it does not find the record that I know exists.  If I then edit/save that record then it finds it.

 

It seems to ONLY work for new records inserted, or existing records saved since the encryption was enabled.

 

Is there a step I am missing to get it to work for all existing values where the records has not been edited?  If not, this seems like a huge flaw.

 

NOTE:  I have tested with Email, Name and Phone fields and NONE of them work for finding existing values.

 

Thanks, Laurie

コメントを記入...
0/9000