0

I have a custom object named Merchant_Application with some custom fields like Fed Tax Id and SSN etc. Since I don't want my Sales Reps to see ful text in these fields so I am making these fields as Text(Encrypted). Now once sales reps create these merchant application, I am providing them a capability to send this information to a third part underwriting system via an API call. But since Sales Reps profile does't have "View Encrypted Date" privileges, SOQL query in APEX is retrieving only the masked value. The challenge for me is that how can I send this value as full value instead of masked value and still show Sales Rep only masked value in UI? I can't enable "View Encrypted Data" permission for Sales Rep profile because that will give them capability to see the paling text value in UI.

I researched some posts and people are talking about Crypto service. I have never used Crypto service and to me it seemed like I can only decrypt using Crypto if it was encrypted using some key. May be I don't know much about Crypto service. Help me get past this hurdle. Really appreciate it.

Thanks

Improve this question
5
  • 1
    Have you actually tried to send the data somewhere? We have encrypted fields that get sent to external services and they are unencrypted when received. Just because it shows in the log masked does not mean that is how it is sent – Eric Sep 28 '17 at 21:21
  • Would making the callout in @future make it in system rather than user mode & decrypt the data? – eyescream Sep 28 '17 at 21:22
  • @eyescream - we don't use future methods and they get sent just fine. – Eric Sep 28 '17 at 21:28
  • @Eric - thanks for the info. I haven't tried actually sending it. I just saw in the log and was wondering if this will be sent as masked. I will try it and see how it works. – Suresh Dalal Sep 29 '17 at 13:24
  • this is confusing since all trailheads and almost all documentation says what View Encrypted Data permission is needed to decrypt data and get unmasked data values while in fact it is no longer needed since Spring 17. – Patlatus Feb 5 '18 at 12:29
1

This topic is confusing since all trailheads and almost all documentation says what View Encrypted Data permission is needed to decrypt data and get unmasked data values while in fact it is no longer needed since Spring 17.

This article suggests that since Spring 17 release you no longer need View Encrypted Data permission to get unmasked value of fields encrypted by Platform Encryption, which means data is always unmasked unless

  1. The tenant secret key used to encrypt data was destroyed.
  2. Salesforce decryption service is temporarily unavailable to decrypt data.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.