| name | salesforce-shield-architecture |
| description | Salesforce Shield as an architectural choice — Platform Encryption + Event Monitoring + Field Audit Trail as three SEPARATELY-LICENSED components, none of which ship in any standard edition. Covers BYOK vs Cache-Only Key Service (CCKM) tradeoffs, probabilistic vs deterministic encryption schemes, the field-type encryption blocklist (Formula, Roll-Up Summary, indexed External ID), Field Audit Trail's 10-year retention model, and why every Shield design starts with a license confirmation. NOT for individual feature setup steps (see security/platform-encryption, security/event-monitoring, security/field-audit-trail), NOT for compliance certification mapping (HIPAA / FedRAMP / PCI specifics). |
| category | architect |
| salesforce-version | Spring '25+ |
| well-architected-pillars | ["Security","Reliability","Operational Excellence"] |
| triggers | ["salesforce shield license required which components","platform encryption probabilistic vs deterministic decision","byok cache-only key service cckm comparison","field audit trail retention 10 year configuration","shield platform encryption field types blocklist formula rollup","salesforce shield architecture compliance design"] |
| tags | ["shield","platform-encryption","event-monitoring","field-audit-trail","byok","cache-only-keys","compliance-architecture"] |
| inputs | ["Compliance driver (HIPAA, FedRAMP, PCI, internal policy) and which Shield components address it","Existing Salesforce edition and which Shield licenses are already provisioned","Field-level inventory of what must be encrypted vs filtered/sorted","Key-management posture (Salesforce-managed, BYOK upload, Cache-Only HSM)","Audit retention requirement in years"] |
| outputs | ["Shield component selection (Platform Encryption / Event Monitoring / Field Audit Trail) with the matching license per component","Encryption scheme decision per field (probabilistic vs deterministic) tied to filter/sort requirements","Key management mode decision (Salesforce-managed / BYOK / Cache-Only) tied to compliance posture","Field Audit Trail retention policy XML for each archived object","License-confirmation pre-flight checklist that runs before any Shield Setup work"] |
| dependencies | [] |
| version | 1.0.0 |
| author | Pranav Nagrecha |
| updated | 2026-05-04T00:00:00.000Z |
Salesforce Shield Architecture
Shield is the wrong size of question to answer with "go to Setup → enable
encryption". It's three separately-priced add-on products — Platform
Encryption, Event Monitoring, Field Audit Trail — sold per-org, none
included in any standard edition. The architectural decision is which
components, with what posture, against which fields, and that has to
happen before anyone clicks anything in Setup.
This skill is the architectural decision layer. The setup mechanics for
each component live in their own skills:
security/platform-encryption, security/event-monitoring,
security/field-audit-trail. Compliance certification mapping
(specifically what HIPAA / FedRAMP-High / PCI require from Shield) lives
in a separate skill — Shield is part of the answer to those, not the
whole answer.
Before Starting
- Confirm every Shield license you're about to assume. Setup → Company
Information → Permission Set Licenses. Three distinct lines: Platform
Encryption, Event Monitoring, Field Audit Trail. The most common
Shield-architecture failure is recommending a feature against an org
that doesn't have the license — a 3-month procurement cycle becomes
visible in the design review, not afterwards.
- Inventory the fields. For each candidate-encryption field: data
type (some types can't be encrypted at all), whether filter / sort /
group-by is required, whether full-text search is required, and
whether external IDs depend on it.
- Decide the key-management posture before picking components. A
Cache-Only Key Service design has implications for every Shield
component (single point of unavailability) — choosing it after
picking components forces rework.
- Decide retention up-front. Field Audit Trail retention is set per
object in metadata XML, with a maximum of 10 years. Plan storage
cost and the 18-month-tier vs longer-tier transition.
Core Concepts
Shield's three components, each with its own license
| Component | What it does | License (separately purchased) |
|---|
| Shield Platform Encryption | At-rest encryption of selected fields, files, search indexes. Uses Salesforce-managed or customer-supplied keys. | Platform Encryption PSL |
| Event Monitoring | Hourly / real-time event log files (Login, API, Apex, Visualforce, etc.) and Real-Time Event Monitoring streams via Pub/Sub. Backs Transaction Security Policies for in-flight blocking. |
