I've been reading the Salesforce Security Guide and it mentions involving Salesforce Shield and Platform Encryption that it

allows you to natively encrypt your most sensitive data at rest across all your Salesforce apps.

What does "at rest" mean? How is this different than an encrypted field?


The "encrypted fields" feature use encryption keys managed by Salesforce, only works for custom fields, and can show masked data (e.g. ***-**-1234 instead of the full 9 digit number). Platform encryption uses encryption keys defined by the customer, can encrypt many standard and custom fields and file types, but cannot show masked data.

Data at rest simply refers to data that is stored in the database (i.e. while is is on the hard drive of one of the servers). It is decrypted on demand when the records are retrieved from storage, and encrypted on demand when stored to the database.

Encrypted fields is primarily for HIPAA and other privacy requirements, while platform encryption is primarily for complying with government and security regulations regarding how data is stored when placed on permanent storage.

Note that "permanent storage" does not mean the data can never be altered or removed, but simply means that when the servers are rebooted, that data is not lost. This is opposed to temporary storage (e.g. RAM) that may be lost in the event of power failure, a reboot, etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.