The Master HSM is platform infrastructure not directly configurable by customers. The steps below cover the customer-side decisions about how to relate to it.
- Understand the layering
Read Salesforce documentation on the Shield key hierarchy. Confirm understanding before evaluating customer-managed alternatives.
- Decide on key model
Salesforce-Managed (relies entirely on Master HSM), BYOK (customer secret wrapped by Master HSM), or Cache-Only (customer HSM external to Salesforce). Each has different trust assumptions.
- For BYOK, plan secret generation
Generate customer tenant secret in customer HSM. Coordinate the wrapping process with Salesforce documentation.
- For Cache-Only, plan KMS infrastructure
Stand up the customer KMS endpoint. Configure connectivity from Salesforce. The Master HSM still participates in trust chain.
- Document compliance posture
For audits, reference Salesforce compliance attestations describing the Master HSM. Include in customer compliance documentation.
- Monitor key operations
Use Event Monitoring to watch key operation patterns. The Master HSM operations themselves are not customer-visible, but downstream operations are.
- Review annually
As compliance requirements evolve, revisit whether the current key model still satisfies. The choice between Salesforce-Managed, BYOK, and Cache-Only is reversible but operationally heavy.
Master HSM is the entire customer key infrastructure. Simplest mode.
Customer HSM generates secret; Master HSM wraps it. Layered model.
Customer HSM holds secret persistently. Master HSM only in transient operations.
Documentation Salesforce provides describing the Master HSM. Customer audit reference.
Choice between models. Reversible but operationally heavy.
- The Master HSM is not customer-configurable. Customers cannot inspect or audit it directly; trust depends on compliance attestations.
- Salesforce-Managed Keys rely entirely on the Master HSM. Customers needing more direct control use BYOK or Cache-Only.
- BYOK secret upload uses Master HSM wrapping. Without the Master HSM, BYOK could not work cryptographically.
- Cache-Only Key Service still involves the Master HSM in trust chain operations. Not a complete escape from Salesforce-controlled cryptography.
- Compliance audits expect documentation, not direct HSM access. Reference Salesforce attestations rather than expecting to demonstrate the HSM directly.