3

This is a Multi-part question....

  1. If I wanted to utilize the Salesforce KMS. Do I just need to hit the Generate Tenant Secret button on both the Data In Salesforce and Data in Salesforce (deterministic)? Then Salesforce KMS generates the key in the background automatically? With no more input from me?

  2. Let's say in a year, I need to generate new keys....Do I just hit Generate Tenant Secret again, and then use the "sync" feature, to encrypt all my data with the new key? Then, in another year, just do the same process, and the first key can fall off? Is there any steps I should do to back anything up during this key rotation process?

  3. Do Most people just "export" the key, just to save it in a different place for backup purposes? When I export, does anything happen to the key stored within Salesforce?

Thanks!

1

This is my thoughts:

If I wanted to utilize the Salesforce KMS. Do I just need to hit the Generate Tenant Secret button on both the Data In Salesforce and Data in Salesforce (deterministic)? Then Salesforce KMS generates the key in the background automatically? With no more input from me?

Yes, this is correct.

Let's say in a year, I need to generate new keys....Do I just hit Generate Tenant Secret again, and then use the "sync" feature, to encrypt all my data with the new key? Then, in another year, just do the same process, and the first key can fall off? Is there any steps I should do to back anything up during this key rotation process?

From the Platform Encryption self-service sync exceptions

Synchronizing your data with your active key material keeps your encryption policy up-to-date and ensures that all existing data is properly encrypted. You can sync data in most standard and custom fields, and field history and feed tracking changes, from the 'Encryption Statistics and Data Sync' page in Setup

Do Most people just "export" the key, just to save it in a different place for backup purposes? When I export, does anything happen to the key stored within Salesforce?

Only privileged user, specially SysAdmin should have permission to export this and should keep in a secure place. Nothing will not happen to the kep stored with Salesforce.

  • Pretty spot on. Only thing I would add is that with the upcoming Winter release (available in preview sandboxes now) the background encryption sync now supports all fields as well as files & attachments. – John Whelan Sep 16 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.