What is the Difference between Encrypted Tenant Secret and Hashed Tenant Secret in Platform Encryption when we click on Upload Tenant Secret. Also we have third party Tenant Wrapping key so would like to know in which option do I need to upload it in either in Encrypted or Hashed Tenant Secret



There are two ways tenant secret can be generated. If you purchase Salesforce Shield license, then you can generate tenant secret from Salesforce.

Generate a Tenant Secret with Salesforce

You can periodically rotate tenant secrets and data can be encrypted with those keys.

You can also generate your own tenant secret (BYOK) if you don't want to use Salesforce provided tenant secrets. Refer Generate Your Own Tenant Secret (BYOK)

It is based your organization's security policy which tenant secrets you could use. If an organization generates their own secrets then they will try to use Hashed tenant secrets.

Just want to clarify, if you upload any of the above secrets then only newly created or edited records can be encrypted. To encrypt existing records, you need to contact Salesforce so that they will run background jobs for that.

According to documentation Generate and Wrap Your Tenant Secret, Tenant wrapping key contains:

Generate a random number as your tenant secret. Then calculate an SHA256 hash of the secret, and encrypt it with the public key from the certificate you generated.

|improve this answer|||||
  • 1
    Thanks for the update !!!! Could you let me know the difference between Encrypted Tenant , Hashed Tenant and also What does Tenant Wrapping key contain, does it contain both encrypted and Hashed tenant. – Rushabh Shah May 8 '18 at 11:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.