Skip to main content
主题#Shield Platform Encryption

#Shield Platform Encryption0 人正在讨论

提问...
Khushbu Patel 发布于 #Shield/Platform Encryption
2025年11月27日 07:31

Hi all

My company has decided to enable encryption, but the process is a bit confusing for me since I haven’t done this before. Has anyone enabled both database-level and field-level encryption? Do we have to enable both? How do you manage your keys and handle backups?

I’m especially concerned about key management — whether it’s better to use the Salesforce-managed keys or go with BYOK. How do you handle key rotation and key backups?

#Shield/Platform Encryption #Encryption Key #Field Level Encryption #Shield Encryption #Encryption Discussion #Shield Platform Encryption #Encrypted #Deterministic Encryption #Platform Encryption
撰写评论...
0/9000
Michael Kaplan (Mindex 的 Solutions Lead) 发布于 Salesforce DX
2019年10月31日 19:32

Has anyone found a way to enable Shield Platform Encryption using SFDX? We've gotten it so that we can deploy Health Cloud with DX, but we also need to enable Shield Encryption for many of our test scenarios.

1 条评论
  1. Jan Aertgeerts (Harrier)
    2019年11月1日 11:34

    There's a few manuals steps to it or post setup:

    - Ensure you enable the PlatformEncryption feature in your scratch org def file.

    - You need to have a Permission Set that has "Manage Encryption Keys" permissions. For the sake of simplicity I assume this is a permission set called "EncryptionManagement".

    - Once setup, push the source so that the permission set is available. Do not include any encrypted fields.

    - Run the following commands:

    sfdx force:user:permset:assign -n EncryptionManagement

    sfdx force:data:record:create -s TenantSecret -v "Description='WHATEVER DESCRIPTION'"

    - Redeploy the fields with encryption enabled.

    - OPTIONAL: If you plan on using Deterministic Encryption you also need the following steps right after creating the first TenantSecret:

    - Manual Step - Enable Deterministic Encryption in Encryption Settings

    - Run sfdx force:data:record:create -s TenantSecret -v "Description='WHATEVER DESCRIPTION' Type=DeterministicData"

    - Deploy the deterministically encrypted fields

    This is a pretty manual flow and will require you to split up your push in 2 phases (with and without encrypted fields).

撰写评论...
0/9000