Salesforce Security Guide
jNewer Version Available
Upload Your Tenant Secret
Once you have your tenant secret, upload it to Salesforce. The Shield Key Management
Service (KMS) uses your tenant secret to derive your org-specific data encryption
key.
| Available as an add-on subscription in: Enterprise, Performance, and Unlimited Editions. Requires purchasing Salesforce Shield. Available in Developer Edition at no charge for orgs created in Summer ’15 and later. |
| Available in both Salesforce Classic and Lightning Experience. |
| User Permissions Needed | |
|---|---|
| To manage key material: |
Manage Encryption Keys ANDManage Certificates |
- From Setup, in the Quick Find box, enter Platform Encryption, and then select Key Management.
- Click Bring Your Own Key.
-
In the Upload Tenant Secret section, attach both the encrypted key material and
the hashed plaintext key material. Click Upload.
This tenant secret automatically becomes the active tenant secret.
Your tenant secret is now ready to be used for key derivation. From here on, the Shield Key Management Service (KMS) uses your tenant secret to derive an org-specific data encryption key. The app server then uses this key to encrypt and decrypt your users’ data.
-
Export your tenant secret and back it up as prescribed in your organization’s
security policy.
To restore your tenant secret, reimport it. The exported tenant secret is different from the tenant secret you uploaded. It’s encrypted with a different key and has additional metadata embedded in it. See Back Up Your Tenant Secret in Salesforce Help.