Shield: Encrypted Fields not encrypted

Question

I have enabled platform encryption in a sandbox, and chosen to encrypt a few fields in the Contact object. However, when a user without the "View Encrypted Data" permission views a contact record, that user can still see the true value of the field I chose to encrypt. Is there another permission set I need to disable?

Answer 1

The implementation guide document is outdated.

Read this knowledge article

View Encrypted Data permission not needed with Shield Platform Encryption since Spring ‘17

Beginning in Spring ’17, you can control who sees encrypted data using the same permission sets, profiles, and field-level security settings that you use to secure your non-encrypted data.

When this change takes place, you will no longer be able to use the “View Encrypted Data” permission to control who sees unmasked encrypted field values. Instead, all users with read access for a field or record will see its contents in the presentation layer in plaintext when it’s encrypted at rest. Users who don’t have access to a field, record, or object won’t see that information, whether it’s encrypted or not.

This update decouples masking capabilities from Shield Platform Encryption.

Trust is our top priority. While our out-of-the-box field- and object-level controls secure access to specific fields, records, and objects, encryption puts a wrapper around your entire org. Think of it like a castle: Moats protect the castle, securing everything inside. But those you welcome into the castle might not be able to enter certain rooms because they don’t have the keys to the doors. Similarly, encryption adds yet another level of security to your data at rest, and field-level security limits access to specific users and information.

This change doesn’t affect Classic Encryption. If you have questions about how this change impacts you and your org, contact your Salesforce account executive.

How will this be implemented?

The Spring '17 release pushed a CRUC to existing customers. VED will by default be not applicable to customers purchasing Platform Encryption from Spring '17 release onwards.