6

I've submitted a support ticket to enable Transparent Data Encryption (TDE) on a Marketing Cloud instance. Since all of the encryption happens on the backend as opposed to Field Level Encryption (FLE) on the application layer, how do we really know if this is implemented?

Transparent Database Data Encryption, also called TDE, uses a feature of SQL Server to encrypt the entire database transparently. This feature stores the entire database in an encrypted format at rest at the file level. This feature will prevent someone with physical access to the database or a backup copy of the database from mounting it on another SQL server instance and accessing data. TDE involves minimal performance implications and no loss of functionality. TDE uses AES-256 encryption to generate the key.

Whereas with Field Level Encryption (FLE), the encryption is on the application layer and email address has to be encrypted, with TDE is it just a matter of trusting their word or would they provide the database encryption key (DEK)?

Improve this question
1
  • Support will be unable to enable this, this is a paid feature and would be handled by the Account team
    – EazyE
    Commented May 3, 2019 at 18:03

2 Answers 2

Reset to default
7

TDE is, as EazyE also mentions, a paid feature. You should reach out to your Account Executive to have it enabled, but it will come at a price.

Do observe, if you accept the cost, it might not be straightforward to enable. Is your environment on a shared DB, you will be assigned a new MID. Only if you are on a dedicated DB, TDE should be possible to apply to your existing MID.

And validating can only be done by Salesforce, so it is indeed a matter of trust. Since this is using SQL own encryption at file system level, it is not reflected in the application in any way.

Improve this answer
2

I worked on an account that migrated to TDE. I had the same question as you: "how do we know this is actually implemented?"

There is no way for you to see this on the platform, but on request, Salesforce can send you a screenshot that this is enabled (I know of one client that has obtained this). It's only a screenshot though — apparently that's all they can do.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .