Shield Platform Encryption versus Classic Encryption
Key Takeaway
Classic Encryption comes with the base user license and protects values in its dedicated encrypted custom field type. Shield Platform Encryption is a paid add-on that covers a much broader range of data, including files and attachments, so encrypting files and attachments at rest requires Shield Platform Encryption.
Salesforce offers two ways to encrypt sensitive data: Classic Encryption and Shield Platform Encryption. Classic Encryption comes with the base user license and uses a dedicated encrypted custom field type. Shield Platform Encryption is a paid add-on that encrypts data at rest with keys you control. It works through either Field-Level Encryption or Database Encryption. When a business, legal, or compliance rule says data must be encrypted, your choice decides what data you can protect, how much control you have over the keys, and how search works on that data.
Classic Encryption versus Shield Platform Encryption
| Classic Encryption | Shield Platform Encryption | |
|---|---|---|
| Cost | Included in the base user license at no extra cost | Additional fee (free in Developer Edition) |
| Encryption | 128-bit AES | 256-bit AES |
| What it encrypts | Values stored in a dedicated encrypted custom field type, limited to 175 characters | A much broader range of data, including fields, files, and attachments |
Shield Platform Encryption is available in Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses. Unlike Classic Encryption, Shield Platform Encryption gives you control over key material.
Classic Encryption encrypts values that you store in its dedicated encrypted custom field type. A file or an attachment isn't a value in a custom field, so Classic Encryption doesn't encrypt it. To encrypt files and attachments at rest, you need Shield Platform Encryption. Encrypting fields, files, and attachments with Shield Platform Encryption doesn't affect your org's storage limits.
Lena is the admin for a small insurance broker. Agents record each client's policy number, a short value like PX-48213-77. Lena stores it in an encrypted custom field, which uses Classic Encryption. The value fits within 175 characters, and the base user license already includes Classic Encryption. Later, the compliance team asks Lena to encrypt the signed policy PDFs that agents upload to client records. A PDF isn't a value in a custom field, so Classic Encryption doesn't cover it. Lena's company buys Shield Platform Encryption, which covers files and attachments.