Security Implementation Guide

Salesforce Security Implementation Guide
Security Overview
User Authentication
User Authorization
Data Sharing Tools
Monitoring Your Organization's Security
Platform Encryption
Encrypt Fields and Files
Manage Tenant Secrets and Keys
Create a Secret
Rotate Keys
Export a Key
Destroy a Key
How It Works
Security Tips for Apex and Visualforce Development
PDF

Manage Tenant Secrets and Keys

With Platform Encryption, you manage your own tenant secret, which is used to derive the keys that protect your data. After you create a unique tenant secret for your organization, you can rotate it, archive it, and share responsibility for it with other users.
Available in: Enterprise, Performance, and Unlimited Editions. Available in Developer Edition at no charge for organizations created in Summer ’15 and later.
Available in Salesforce Classic only.

User Permissions Needed
To manage tenant secrets: “Manage Encryption Keys”

Authorized users generate tenant secrets on demand from the Platform Encryption page. Authorized developers can generate them by coding a call to the TenantSecret object in the Salesforce API.

Data encryption keys are never shared across organizations or saved to any disk. Instead, they are derived on demand from a master secret and an organization-specific tenant secret and then cached on an application server.