Field History Tracking - control access to history?

Question

re: the Field History Tracking feature, which you can turn on for specific objects and then specific fields within those objects:

Is there any way to control access to the Field History? Apart from the Related List on the page there is also a Report Type for Field History on each object. This report type would appear to be available to anyone with access to the object.

This seems like a bit of a security leak, or is it clever enough to respect Field Level Security and Sharing Rules when it shows the history to someone?

Answer 1

Yes, the Field History feature respects both Sharing Access and Field Level Security. You can't report on records you can't see, and you can't find values in fields you cannot access. The Field History Tracking documentation suggests this.

If a trigger causes a change on an object the current user doesn’t have permission to edit, that change is not tracked. Field history honors the permissions of the current user. (Emphasis Added)

That said, it does fully protect that data from being seen.