I was curious, I have been reading the Shield Encryption Implementation Guide. I am wondering if there was a strategy you took when implementing Shield Platform Encryption? Did you encrypt straight in production following a backup? Did you create a developer sandbox and test encryption, then implement encryption into production(as I understand you can't use change sets for encryption on standard objects)? Did you take a different approach? Deploying anything straight into prod makes me cringe, but the amount of actual value that would be gained implementing into a developer sandbox seems minimal. Any information you can provide will be greatly appreciated!!!

1 Answer 1


When implementing Shield Platform Encryption for the first time, you should start by doing a data classification exercise: Understand what data you have, and of that data what do you actually need to encrypt. This will be helpful, as you really don't want to encrypt everything - only the things required by policy or regulations.

Assuming you've done that exercise, you should begin by testing your implementation in sandbox first. Dev is fine initially, but full copy would be ideal for ensuring everything that you need to work actually does work. You'll also need an understanding of what encryption scheme you'll need for your data (probabilistic or deterministic), which depends on your use cases.

Don't rush it - deploy it into the sandbox at whatever pace works for you, but ensure you've given enough time to test functionality BEFORE taking it into production.

You actually can use change sets to enable encryption on standard objects.

One thing to keep in mind also - when enabling encryption any NEW (or newly saved) data will be encrypted, but existing data will not. For non-LTA fields you can use the self-service background encryption sync service to force encryption of older data (available in setup -> Platform Encryption -> Statistics), for LTA fields, Chatter feed, or files and attachments you'll have to have support run a background encryption sync (self-service for those are coming in a future release).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .