Security Implementation Guide

Salesforce Security Implementation Guide
Security Overview
User Authentication
User Authorization
Data Sharing Tools
Monitoring Your Organization's Security
Platform Encryption
Encrypt Fields and Files
Manage Tenant Secrets and Keys
How It Works
Best Practices
Encryptable Fields
Terminology
Encryption Flow
Validation
Permissions
Deployment
Sandbox
Classic Encryption
Encryption Considerations
Security Tips for Apex and Visualforce Development
PDF

Newer Version Available

This content describes an older version of this product. View Latest

Which Fields Can I Encrypt?

You can encrypt certain fields on the Account, Contact, Case, and Case Comment objects. When Platform Encryption is on, users with the “View Encrypted Data” permission can see the contents of encrypted fields, but users without that permission see only masked values (that is, the values are replaced with asterisks).
Available in: Enterprise, Performance, and Unlimited Editions. Available in Developer Edition at no charge for organizations created in Summer ’15 and later.
Available in Salesforce Classic only.

In either case, encrypted fields work normally throughout the Salesforce user interface, business processes, and APIs. (There are some exceptions; for example, encrypted fields can’t be sorted.)

When you turn encryption on, existing field values aren't encrypted immediately. Values are encrypted only after they are touched. Contact Salesforce for help encrypting existing data.

Encrypted Standard Fields

You can encrypt the contents of these standard field types.

  • On the Account object:
    • Account Name
  • On the Contact object:
    • Email
    • Fax
    • Home Phone
    • Mailing Address (Encrypts only Mailing Street and Mailing City)
    • Mobile
    • Name (Encrypts First Name, Middle Name, and Last Name)
    • Other Phone
    • Phone
  • On the Case object:
    • Subject
    • Description
  • On Case Comments:
    • Body

Encrypted Custom Fields

You can encrypt the contents of these custom field types:
  • Email
  • Phone
  • Text
  • Text Area
  • Text Area (Long)
  • URL

Once a custom field is encrypted, you can’t change the field type. For custom phone and email fields, you also can't change the field format.

Important

You can't use currently or previously encrypted custom fields in custom formula fields or criteria-based sharing rules.

You can't use Schema Builder to create an encrypted custom field.

Some custom fields can’t be encrypted:

  • Fields that have the Unique or External ID attributes or include these attributes on previously encrypted custom fields
  • Fields that are used in custom formula fields
  • Fields on external data objects

This information applies to Platform Encryption and not to Classic Encryption.

Note