DuoKey for Salesforce
Product sheet. 4 pages, 2025.
How to use your own encryption key with Salesforce Shield Platform Encryption. It covers three Salesforce options, Bring Your Own Key, External Key Management, and Cache-Only Key Wrapper, plus storing the key in an HSM or splitting it with multi-party computation. Download it to compare the three options side by side and pick the one that fits your compliance requirements.
Get the download
Tell us where to send the link. A business email is required.
In 2023, misconfigured Salesforce community sites exposed applicant data, including for a Vermont pandemic unemployment programme. Encryption only helps if the key is not sitting next to the data.
Salesforce gives you three ways to bring your own key. Choosing between them is not obvious. The sheet sets out Bring Your Own Key, External Key Management, and Cache-Only Key Wrapper, and includes an architecture diagram from Shield to the external key.
Download it to see which option fits your regulator, and how DuoKey keeps the key out of Salesforce without changing anything for your users.
FAQ
Who is this for?
Salesforce administrators and security teams who use, or are evaluating, Shield Platform Encryption and need the key held outside Salesforce.
What is Cache-Only Key Wrapper?
A Salesforce option where Salesforce fetches the key when it needs it and does not store it. The sheet explains how DuoKey supplies that key.
Do users notice a difference?
No. Users keep working in Salesforce as before. The change is where the key is held.
Which regulations does it mention?
FINMA, HIPAA, GDPR, and LIPAD.