The IV is a property of the encryption scheme rather than something administrators configure directly. The steps below cover the IV-related decisions during Shield rollout and the patterns for custom Apex encryption.
- Decide which fields need encryption
Work with security and compliance to list sensitive fields. Each will need a scheme decision: probabilistic or deterministic.
- Audit SOQL patterns per field
For each candidate field, check what SOQL queries filter, sort, or group by it. Fields used in queries usually need deterministic encryption to preserve functionality.
- Choose scheme per field
For low-cardinality fields where pattern reveal is acceptable (Country, State), deterministic is fine. For high-sensitivity high-cardinality fields (SSN, account number), probabilistic.
- Enable encryption with chosen scheme
Setup > Encryption Settings > Encrypted Fields. Edit each field, check Encrypted, choose scheme. The platform manages IV generation per the scheme.
- For custom Apex, use encryptWithManagedIV
Any Apex code that encrypts data should use Crypto.encryptWithManagedIV() rather than the manual encrypt(). Managed IV removes developer-side IV mistakes.
- Document the IV approach
For compliance audits, document the IV scheme per field and per custom Apex method. Auditors expect to see this documented for any encrypted data path.
- Test edge cases
For deterministic fields, test that equality queries still work post-encryption. For probabilistic, confirm that other operations (decryption on read) still function as expected.
Random IV per record. Strongest security; no SOQL filter/sort.
Derived IV. Allows equality match; reveals value patterns.
Developer-provided IV. More flexible but more error-prone.
Platform-generated IV. Safer default for custom encryption.
Store with ciphertext or derive from plaintext (deterministic). Both are standard; choose based on scheme.
- Probabilistic encryption blocks SOQL filter, sort, and GROUP BY. Reports and queries on the encrypted field break unless the field is also marked filterable.
- Deterministic encryption reveals shared values. Use only for low-sensitivity fields where pattern reveal is acceptable.
- Custom Apex encryption with manual IVs is a common mistake. Hard-coded or predictable IVs catastrophically weaken security.
- IV reuse with the same key is a serious failure. Shield prevents this; custom code must enforce it explicitly.
- Compliance auditors expect documented IV handling. Roll out includes documenting the scheme per field for the audit record.