Shield Platform Encryption encrypts Salesforce data while it is stored (data at rest) using keys your organization controls, so you can meet regulatory, contractual, and internal-policy requirements for sensitive data. It does not replace field-level security or object permissions, and it is not the same as encryption in transit. Salesforce already uses Transport Layer Security (TLS) for traffic on the wire. You choose a policy that covers the transactional database, selected fields, and related stores such as files and search indexes, then generate matching secrets and prove the same setup in a sandbox before production.