Platform Encryption Global Search and Search Index

Question

I'm trying to use SF Platform Encryption.

Main question is if the global search in Salesforce should work also with encrypted fields when using wildcard search? (for example, by searching: "Test Va*")

At this stage, I encrypted most of the Account/Contact standard fields with Deterministic key. This enable to use encryption fields as filter in queryes, but only with the exact value. So, as expected, when writing apex code:

Contact c = [Select Id From Contact Where Email = 'test@test.com'];

It's fine.

But below code result with complication error: "The operator like is not supported on an encrypted field"

Contact c = [Select Id From Contact Where Email Like 'test@test%'];

What I cannot understand is why/how the global search working fine with both searches: "test@test.com" or "test@test*"

Thought that it is related to SF indexing, so I read in this link about Encrypt Search Index Files (https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_pe_search_encryption_enable.htm)

Sometimes you need to search for personally identifiable information (PII) or data that’s encrypted in the database. When you search your org, the results are stored in search index files. You can encrypt these search index files, adding another layer of security to your data.

I did according to the steps there and create encryption also for the indexing, but still getting the same result, and the global search working fine also with wildcards. Not sure if this is the expected or I'm missing any configuration.

+Generally, the idea that data that should be encrypted might be stored in indexing files (unless the customer doing additional encryption) seems disturbing and violate the target of the encryption.

Answer 1

They are stored differently. Global search is stored used a different indexing system.

When you search your org, the results are stored in search index files. You can encrypt these search index files, adding another layer of security to your data.[1]

The search index is encrypted differently than the record level data-at-rest. It's optimized for search abilities such as LIKE.

The SOQL you provide queries against the data(or data indexes)-at-rest. This doesn't handle partial queries well. If you want to perform a query in Apex against the search index, you can always use SOSL. Links to the Trailhead and Dev Guide.