The IV is a property of the encryption scheme rather than something administrators configure directly. The steps below cover the IV-related decisions during Shield rollout and the patterns for custom Apex encryption.
- Decide which fields need encryption
Work with security and compliance to list sensitive fields. Each will need a scheme decision: probabilistic or deterministic.
- Audit SOQL patterns per field
For each candidate field, check what SOQL queries filter, sort, or group by it. Fields used in queries usually need deterministic encryption to preserve functionality.
- Choose scheme per field
For low-cardinality fields where pattern reveal is acceptable (Country, State), deterministic is fine. For high-sensitivity high-cardinality fields (SSN, account number), probabilistic.
- Enable encryption with chosen scheme
Setup > Encryption Settings > Encrypted Fields. Edit each field, check Encrypted, choose scheme. The platform manages IV generation per the scheme.
- For custom Apex, use encryptWithManagedIV
Any Apex code that encrypts data should use Crypto.encryptWithManagedIV() rather than the manual encrypt(). Managed IV removes developer-side IV mistakes.
- Document the IV approach
For compliance audits, document the IV scheme per field and per custom Apex method. Auditors expect to see this documented for any encrypted data path.
- Test edge cases
For deterministic fields, test that equality queries still work post-encryption. For probabilistic, confirm that other operations (decryption on read) still function as expected.
Random IV per record. Strongest security; no SOQL filter/sort.
Derived IV. Allows equality match; reveals value patterns.
Developer-provided IV. More flexible but more error-prone.
Platform-generated IV. Safer default for custom encryption.
Store with ciphertext or derive from plaintext (deterministic). Both are standard; choose based on scheme.
- Probabilistic encryption blocks SOQL filter, sort, and GROUP BY. Reports and queries on the encrypted field break unless the field is also marked filterable.
- Deterministic encryption reveals shared values. Use only for low-sensitivity fields where pattern reveal is acceptable.
- Custom Apex encryption with manual IVs is a common mistake. Hard-coded or predictable IVs catastrophically weaken security.
- IV reuse with the same key is a serious failure. Shield prevents this; custom code must enforce it explicitly.
- Compliance auditors expect documented IV handling. Roll out includes documenting the scheme per field for the audit record.
Keep the related term in your library so you can find this topic again.