My question is how Salesforce encrypted data when it travels to an external system? or are not encrypted? I know that Salesforce use TLS between browser and Salesforce server, but what happen with the data that travels to another system? Thanks.


For email, you can configure TLS settings (required, preferred, or disabled). For Outbound Messaging, TLS is required. For SOAP and REST calls, developers must explicitly disable TLS for the connection in the Remote Site Settings. In other words, except for email, most data is automatically encrypted during transfers, unless disabled intentionally. It is up to the third party to secure the data after transfer.

  • Why should developers disable TLS when using REST calls? Thanks. – JScript Jul 25 '19 at 15:06
  • @JScript Ideally, developers should never disable TLS. Unfortunately, we live in the real world, which means there are servers out there without TLS. In those vanishingly rare cases, disabling TLS enables communications with those servers, at the cost of authenticity and confidentiality that TLS provides. – sfdcfox Jul 25 '19 at 15:50
  • Thanks! That helped! – JScript Jul 25 '19 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.