Salesforce Security Guide
j
No Results
Search Tips:
- Please consider misspellings
- Try different search keywords
How Shield Platform Encryption Works in a Sandbox
Refreshing a sandbox from a production org creates an exact copy of the production
org. If Shield Platform Encryption is enabled on the production org, all encryption
settings are copied to the sandbox, including tenant secrets created in
production.
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
| Available as an add-on subscription in: Enterprise, Performance, and Unlimited Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption. Available in Developer Edition at no charge. |
After a sandbox is refreshed, tenant secret changes are confined to your current org. This means that when you rotate or destroy a tenant secret on the sandbox, it doesn’t affect the production org.
As a best practice, rotate tenant secrets on sandboxes after a refresh. Rotation ensures that production and sandbox use different tenant secrets. Destroying tenant secrets on a sandbox renders encrypted data unusable in cases of partial or full copies.