Does anybody know how to check if Platform Encryption is enabled in a given org? Ideally without using the metadata API.

I don't need to know if a user/permset has access to "View Encrypted Data", I simply have to change some functionality if data is Encrypted (no where clause on some standard fields, for example).

Can't find any docs to that effect... yet

5 Answers 5


I assume there are couple of Objects that will have some Entry if the platform encryption is enabled .

The Two Objects that I would look are TenantSecret and TenantUsageEntitlement

system.debug('$$$'+[SELECT AmountUsed,EndDate FROM TenantUsageEntitlement]);

I have no access to org with Platform Encryption Enabled else I would verify this .I assume TenantSecret object appears only once Platform encryption is enabled

If you want at Object level to see Platform Encyrption is enabled check in describe Object for is encrypted boolean documented here .


I was actually able to find the perfect solution.


That solved it. :)

  • 1
    Yep thats documented as well in the doc that I listed developer.salesforce.com/docs/atlas.en-us.api.meta/api/… Apr 15, 2016 at 19:36
  • isn't this a constrained answer as your would have to know that contact.name is encrypted in your target org? "isEncrypted - This value only appears in the results of a describeSObjects() call when it is true; otherwise, it is omitted from the results." Apr 15, 2016 at 19:39
  • @BenjaminPirih I see your point here . Seb you may want to double check this return false in org where platform encryption is not enabled .This may cause null pointer else Apr 15, 2016 at 19:42
  • 1
    That became the plan, once Ben made the remark above. Though a try-catch around the line (in a utility class) would solve both issues Apr 15, 2016 at 19:43
  • 1
    I can now confirm that sObjectType.Contact.fields.Name.isEncrypted() does not throw an exception when encryption is turned off, or not even activated. Apr 15, 2016 at 20:23

know ideally you didn't want to use metadata API but.. Could you attempt to create an encrypted field with the metadata api.

If this call fails it should return an error message that encryption is not available. If the call succeeds then you need to rollback the creation via another call but you will know that the org feature is enabled. Not pretty..

  • This is for an ISV package. Requesting access to the Metadata API is not something we're ready to do. Apr 15, 2016 at 19:40

You can definitely check if encryption is enabled for a particular field, even if that field lives within an org that doesn't have Platform Encryption provisioned.

The only trickiness is that when Platform Encryption isn't provisioned onto an org, calling Apex Describe on an sObject won't return the IsEncrypted field as part of its result.

You can work around this by checking for both null and false in your Apex code.

Here's a short example of a Visualforce page that utilizes Apex to generate a list of every field associated with the Account sObject, and it's encryptability. You can do something similar in your code to branch based on whether encryption is available for a particular field.

<apex:page >
    <script src="../../soap/ajax/37.0/connection.js" type="text/javascript"></script>

    <script type="text/javascript">
        window.onload = setupPage;

        function setupPage() {
            queryResult = sforce.connection.describeSObject("Account");

            if (queryResult.fields.length > 0) {
            var output = "";

            for (var i = 0; i < queryResult.fields.length; i++) {
                var field = queryResult.fields[i];
                output += field.name + " — " + "Encrypted: " + (field.encrypted ? "true" : "false") + "<br />";

            document.getElementById("output").innerHTML = output;

    <div id="output"></div>

This would output something like this:

Id — Encrypted: false

IsDeleted — Encrypted: false

MasterRecordId — Encrypted: false

Name — Encrypted: true

Type — Encrypted: false

ParentId — Encrypted: false

BillingStreet — Encrypted: false

BillingCity — Encrypted: false

BillingState — Encrypted: false

BillingPostalCode — Encrypted: false

BillingCountry — Encrypted: false

BillingLatitude — Encrypted: false

BillingLongitude — Encrypted: false

BillingGeocodeAccuracy — Encrypted: false

BillingAddress — Encrypted: false

ShippingStreet — Encrypted: false

ShippingCity — Encrypted: false

ShippingState — Encrypted: false

ShippingPostalCode — Encrypted: false

ShippingCountry — Encrypted: false

ShippingLatitude — Encrypted: false

ShippingLongitude — Encrypted: false

ShippingGeocodeAccuracy — Encrypted: false

ShippingAddress — Encrypted: false

Phone — Encrypted: false

Fax — Encrypted: false

AccountNumber — Encrypted: false

Website — Encrypted: false

PhotoUrl — Encrypted: false

Sic — Encrypted: false

Industry — Encrypted: false

AnnualRevenue — Encrypted: false

NumberOfEmployees — Encrypted: false

Ownership — Encrypted: false

TickerSymbol — Encrypted: false

Description — Encrypted: false

Rating — Encrypted: false

Site — Encrypted: false

OwnerId — Encrypted: false

CreatedDate — Encrypted: false

CreatedById — Encrypted: false

LastModifiedDate — Encrypted: false

LastModifiedById — Encrypted: false

SystemModstamp — Encrypted: false

LastActivityDate — Encrypted: false

LastViewedDate — Encrypted: false

LastReferencedDate — Encrypted: false

Jigsaw — Encrypted: false

JigsawCompanyId — Encrypted: false

CleanStatus — Encrypted: false

AccountSource — Encrypted: false

DunsNumber — Encrypted: false

Tradestyle — Encrypted: false

NaicsCode — Encrypted: false

NaicsDesc — Encrypted: false

YearStarted — Encrypted: false

SicDesc — Encrypted: false

DandbCompanyId — Encrypted: false

BRHdjkSmZB__CustomerPriority__c — Encrypted: false

BRHdjkSmZB__SLA__c — Encrypted: false

BRHdjkSmZB__Active__c — Encrypted: false

BRHdjkSmZB__NumberofLocations__c — Encrypted: false

BRHdjkSmZB__UpsellOpportunity__c — Encrypted: false

BRHdjkSmZB__SLASerialNumber__c — Encrypted: false

BRHdjkSmZB__SLAExpirationDate__c — Encrypted: false

BRHdjkSmZB__Encrypted_Text__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_1__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_2__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_3__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_4__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_5__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_6__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_7__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_8__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_9__c — Encrypted: true


Another way to check "no where clause" is to use sObjectType.Contact.fields.Name.isFilterAble().

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .