I have enabled platform encryption in a sandbox, and chosen to encrypt a few fields in the Contact object. However, when a user without the "View Encrypted Data" permission views a contact record, that user can still see the true value of the field I chose to encrypt. Is there another permission set I need to disable?

  • Maybe check View All Data?
    – Adrian Larson
    Jul 31 '17 at 17:50
  • At the system permission level or the Contact object level? View All Data is not set for the test user I am using, and they are still able to view the true value of the field. Jul 31 '17 at 17:52
  • The user level, yeah. Ah well, it was worth checking.
    – Adrian Larson
    Jul 31 '17 at 17:53
  • Please be aware that the "view encrypted data" does not apply anymore to platform encryption, this is only for classic encryption. Aug 4 '17 at 1:52
  • Salesforce has stated in their platform encryption implementation guide that "View Encrypted Data" is the permission needed to view data in encrypted fields. What other permission would allow viewing of encrypted data? Aug 8 '17 at 16:42

The implementation guide document is outdated.

Read this knowledge article

View Encrypted Data permission not needed with Shield Platform Encryption since Spring ‘17

Beginning in Spring ’17, you can control who sees encrypted data using the same permission sets, profiles, and field-level security settings that you use to secure your non-encrypted data.

When this change takes place, you will no longer be able to use the “View Encrypted Data” permission to control who sees unmasked encrypted field values. Instead, all users with read access for a field or record will see its contents in the presentation layer in plaintext when it’s encrypted at rest. Users who don’t have access to a field, record, or object won’t see that information, whether it’s encrypted or not.

This update decouples masking capabilities from Shield Platform Encryption.

Trust is our top priority. While our out-of-the-box field- and object-level controls secure access to specific fields, records, and objects, encryption puts a wrapper around your entire org. Think of it like a castle: Moats protect the castle, securing everything inside. But those you welcome into the castle might not be able to enter certain rooms because they don’t have the keys to the doors. Similarly, encryption adds yet another level of security to your data at rest, and field-level security limits access to specific users and information.

This change doesn’t affect Classic Encryption. If you have questions about how this change impacts you and your org, contact your Salesforce account executive.

How will this be implemented?

The Spring '17 release pushed a CRUC to existing customers. VED will by default be not applicable to customers purchasing Platform Encryption from Spring '17 release onwards.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.