My customer would like to create and store account data in Salesforce. The account data currently exists in the DB behind the firewall and can be accessed though a web service. Account records contain some confidential fields which should be transmitted and stored in SF in a highly secure manner.
I am planning to use the native SOAP API and secure the field data using encrypted fields. Are there any pitfalls with this approach?
Salesforce.com uses SSL Encryption for its API Calls (SOAP / REST via HTTPS). This is same level of encryption for transmitting credit card information over the internet. In general you should be ok for your data during transmission between the systems.
Once the data is stored in SFDC you have additional security considerations you need to take into account. Are you storing Social Security Numbers or very sensitive data in SFDC? If so then you may want to make sure that you also encrypt the data at rest in SFDC.
You can encrypt fields with 128 bit AES at no additional cost this is out of the box. It has some tradeoffs and limits some specific functionalty when you turn it on a field, so read up here so you understand tradeoffs: https://help.salesforce.com/apex/HTViewHelpDoc?id=fields_about_encrypted_fields.htm
If that is not enough for your requirements, in Summer 15 release, a new feature called "Platform Encryption" will be made available for an additional cost. It will allow you 256 bit AES and has a much more robust set of functionality around encryption. http://docs.releasenotes.salesforce.com/en-us/summer15/release-notes/rn_security_platform_encryption.htm
Finally you can always checkout http://trust.salesforce.com for more details.
