Key Management is the Tenant Secret rotation interface for Shield Platform Encryption — generate new keys, mark them active, archive old ones. Periodic rotation reduces blast radius if a key is compromised. The bulk of Shield admin time is here.
- Open Setup → Key Management
Setup gear → Quick Find: Key Management → Key Management.
- Review the active Tenant Secret
Each org has one Active Tenant Secret per data type (data, search index, files). The Active key encrypts new writes; older Archived keys can still decrypt existing data.
- Click Generate Tenant Secret
Salesforce generates a new key. The old key auto-archives.
- (For BYOK) Upload your own key
Bring Your Own Key path: generate a key in your HSM / KMS, upload to Salesforce, and Salesforce uses it to derive the actual encryption keys.
- (Optional) Export the Tenant Secret
Useful for backup / audit. Export is irreversible — once printed, the key material lives in your system too.
- Set rotation cadence
No automatic rotation — admins schedule (or manually trigger) key generation. NIST recommends at least annually.
Salesforce-managed. Quick, no DNS changes.
Bring Your Own Key. You control key custody; Salesforce uses the key but doesn't have the master copy.
Backup the key material to your own systems. Irreversible — once exported, you assume responsibility for security of the exported copy.
Active encrypts new data. Archived keys still decrypt existing data — don't delete them or you lose access to data encrypted with that key.
- Deleting an Archived Tenant Secret destroys access to all data encrypted with that key. Salesforce keeps Archived keys forever by design. Don't try to delete unless you're certain no data references it.
- Key rotation re-encrypts data over time via background jobs — not instantly. After generating a new key, run Setup → Encryption Statistics to monitor re-encryption progress.
- BYOK adds significant operational complexity. Lose the key in your HSM, and your data becomes permanently unrecoverable. Most orgs use Salesforce-Managed unless compliance forces BYOK.