How to check for Platform Encryption

Question

Does anybody know how to check if Platform Encryption is enabled in a given org? Ideally without using the metadata API.

I don't need to know if a user/permset has access to "View Encrypted Data", I simply have to change some functionality if data is Encrypted (no where clause on some standard fields, for example).

Can't find any docs to that effect... yet

Answer 1

I assume there are couple of Objects that will have some Entry if the platform encryption is enabled .

The Two Objects that I would look are TenantSecret and TenantUsageEntitlement

system.debug('$$$'+[SELECT AmountUsed,EndDate FROM TenantUsageEntitlement]);

I have no access to org with Platform Encryption Enabled else I would verify this .I assume TenantSecret object appears only once Platform encryption is enabled

If you want at Object level to see Platform Encyrption is enabled check in describe Object for is encrypted boolean documented here .

Answer 2

I was actually able to find the perfect solution.

sObjectType.Contact.fields.Name.isEncrypted()

That solved it. :)

Answer 3

know ideally you didn't want to use metadata API but.. Could you attempt to create an encrypted field with the metadata api.

If this call fails it should return an error message that encryption is not available. If the call succeeds then you need to rollback the creation via another call but you will know that the org feature is enabled. Not pretty..

Answer 4

You can definitely check if encryption is enabled for a particular field, even if that field lives within an org that doesn't have Platform Encryption provisioned.

The only trickiness is that when Platform Encryption isn't provisioned onto an org, calling Apex Describe on an sObject won't return the IsEncrypted field as part of its result.

You can work around this by checking for both null and false in your Apex code.

Here's a short example of a Visualforce page that utilizes Apex to generate a list of every field associated with the Account sObject, and it's encryptability. You can do something similar in your code to branch based on whether encryption is available for a particular field.

<apex:page >
    <script src="../../soap/ajax/37.0/connection.js" type="text/javascript"></script>

    <script type="text/javascript">
        window.onload = setupPage;

        function setupPage() {
            queryResult = sforce.connection.describeSObject("Account");

            if (queryResult.fields.length > 0) {
            var output = "";

            for (var i = 0; i < queryResult.fields.length; i++) {
                var field = queryResult.fields[i];
                output += field.name + " — " + "Encrypted: " + (field.encrypted ? "true" : "false") + "<br />";
            }

            document.getElementById("output").innerHTML = output;
        }
    </script>

    <div id="output"></div>
</apex:page>

This would output something like this:

Id — Encrypted: false

IsDeleted — Encrypted: false

MasterRecordId — Encrypted: false

Name — Encrypted: true

Type — Encrypted: false

ParentId — Encrypted: false

BillingStreet — Encrypted: false

BillingCity — Encrypted: false

BillingState — Encrypted: false

BillingPostalCode — Encrypted: false

BillingCountry — Encrypted: false

BillingLatitude — Encrypted: false

BillingLongitude — Encrypted: false

BillingGeocodeAccuracy — Encrypted: false

BillingAddress — Encrypted: false

ShippingStreet — Encrypted: false

ShippingCity — Encrypted: false

ShippingState — Encrypted: false

ShippingPostalCode — Encrypted: false

ShippingCountry — Encrypted: false

ShippingLatitude — Encrypted: false

ShippingLongitude — Encrypted: false

ShippingGeocodeAccuracy — Encrypted: false

ShippingAddress — Encrypted: false

Phone — Encrypted: false

Fax — Encrypted: false

AccountNumber — Encrypted: false

Website — Encrypted: false

PhotoUrl — Encrypted: false

Sic — Encrypted: false

Industry — Encrypted: false

AnnualRevenue — Encrypted: false

NumberOfEmployees — Encrypted: false

Ownership — Encrypted: false

TickerSymbol — Encrypted: false

Description — Encrypted: false

Rating — Encrypted: false

Site — Encrypted: false

OwnerId — Encrypted: false

CreatedDate — Encrypted: false

CreatedById — Encrypted: false

LastModifiedDate — Encrypted: false

LastModifiedById — Encrypted: false

SystemModstamp — Encrypted: false

LastActivityDate — Encrypted: false

LastViewedDate — Encrypted: false

LastReferencedDate — Encrypted: false

Jigsaw — Encrypted: false

JigsawCompanyId — Encrypted: false

CleanStatus — Encrypted: false

AccountSource — Encrypted: false

DunsNumber — Encrypted: false

Tradestyle — Encrypted: false

NaicsCode — Encrypted: false

NaicsDesc — Encrypted: false

YearStarted — Encrypted: false

SicDesc — Encrypted: false

DandbCompanyId — Encrypted: false

BRHdjkSmZB__CustomerPriority__c — Encrypted: false

BRHdjkSmZB__SLA__c — Encrypted: false

BRHdjkSmZB__Active__c — Encrypted: false

BRHdjkSmZB__NumberofLocations__c — Encrypted: false

BRHdjkSmZB__UpsellOpportunity__c — Encrypted: false

BRHdjkSmZB__SLASerialNumber__c — Encrypted: false

BRHdjkSmZB__SLAExpirationDate__c — Encrypted: false

BRHdjkSmZB__Encrypted_Text__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_1__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_2__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_3__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_4__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_5__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_6__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_7__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_8__c — Encrypted: true

BRHdjkSmZB__Encrypted_Text_9__c — Encrypted: true

Answer 5

Another way to check "no where clause" is to use sObjectType.Contact.fields.Name.isFilterAble().