---
schema_version: "1"
id: b106166eb2b649919e8199806b483a945aeaef338450a99956f2ccc211718d36
title: Platform Encryption for Data 360
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_platform_encryption_for_data_cloud.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_platform_encryption_for_data_cloud.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0569a0941186d94f6ce3013e84a83e0ae573a420387ee667b0da45f5c1a05f87
description: Some customers require tenant-specific encryption keys, control over key material, or improved key visibility for auditing and compliance reporting. Platform Encryption for Data 360 extends Data 360’s robust security services by adding options for encryption key control and visibility.
products:
  - Data 360
release: "264"
---
# Platform Encryption for Data 360

Some customers require tenant-specific encryption keys, control over key material, or improved key visibility for auditing and compliance reporting. Platform Encryption for Data 360 extends Data 360’s robust security services by adding options for encryption key control and visibility.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;language=en_US&amp;type=5l" target="_blank">Data 360 edition availability</a>.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with add-on license: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and Platform Encryption for Data Cloud. Also, to use the optional External Key Management, requires purchasing the Platform Encryption for Consumption license.</td></tr></tbody></table>

## Encryption Options in Data 360

Salesforce offers three key management options for encrypting data in Data 360.

These options give customers flexibility in how they manage encryption keys and comply with their internal security policies.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:30.76923076923077%">
          <col style="width:69.23076923076923%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d182841e84">Encryption Option</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d182841e87">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Encryption Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e84 ">Customer Managed Keys (CMK)</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e87 ">Salesforce generates and manages tenant-specific keys in the Salesforce
              UI.</td>

          </tr>
          <tr class="">
            <td data-label="Encryption Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e84 ">EKM</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e87 ">
              <p style="margin-bottom:0;">Customers manage encryption keys externally using an AWS KMS account.</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="Encryption Option" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e84 ">Bring Your Own Key (BYOK)</td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d182841e87 ">Customers can bring their own key material directly into the Salesforce UI
              without needing an AWS KMS account. This option benefits customers who prefer not to
              access AWS KMS or use other key storage providers such as Azure or on-premise
              vaults.</td>

          </tr>
        </tbody>
      </table>

All data in Data 360 is encrypted at rest in AWS by Salesforce-managed data encryption keys (DEKs). This is the Customer Managed Keys option. With Platform Encryption for Data 360, you create a Data 360 root key in Salesforce. You can also use EKM to create the key in an external Key Management System (KMS) or BYOK. Your Data 360 root keys are specific to your org, and control the DEKs that encrypt and decrypt your data, giving you ownership of the key chain that secures your information.

Platform Encryption for Data 360 encrypts data only in your production environment. Sandbox environments are not automatically encrypted when you enable encryption in production. To encrypt data in a sandbox, you need to turn on Manage Data 360 Keys feature separately in each sandbox.

Root keys are compatible with Sub-Second Real-Time feature. However, when you enable Sub-Second Real-Time in an org with an active Salesforce root key for Data 360, the root key becomes usable within 24 hours.

![A dialog box displays options for configuring a key management service.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-data-data_cloud-264-0-0-production-enus/f3569962-3c9b-4f83-9d0c-b6a574e785da/data_cloud/images/KMS_with_BYOK.png)

## Default Data 360 Encryption without Platform Encryption

By default, Data 360 uses end-to-end encryption to secure data as it transits into Data Cloud and between products within the trust boundary. Hyperforce’s infrastructure-level encryption provides cloud-native disk encryption for data stored at rest. While infrastructure-level keys aren’t tenant-specific, Salesforce stores these keys securely and rotates them regularly.

To learn more about how Data 360 and Hyperforce secure your data, see [Salesforce Security and Compliance page](https://compliance.salesforce.com/en)

- **[Set Up Platform Encryption for Data 360](https://help.salesforce.com/s/articleView?id=data.c360_a_setup_platform_encryption_data_cloud.htm&release=264.0.0&type=5)**  
    When you enable Platform Encryption, your first Data 360 root key generates automatically. This key encrypts all previously ingested data in Data 360. After the initial setup, you can continue to use the generated root key or configure an external key using External Key Management (EKM), or leverage your own key material using Bring Your Own Key (BYOK) in the Salesforce UI to encrypt data in Data 360. You can rotate root keys periodically and view key metadata, such as creation time and creator, in Setup.
- **[Root Key Lifecycle](https://help.salesforce.com/s/articleView?id=data.c360_a_root_key_lifecycle.htm&release=264.0.0&type=5)**  
    Root key statuses in Platform Encryption define the usage of each key for data encryption and decryption.

#### See Also

- [_Salesforce Help_: Encrypt Data Cloud with Customer-Managed Root Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_enable_pe_for_data_cloud.htm&type=5&language=en_US)
- [_Salesforce_: Security and Compliance](https://compliance.salesforce.com/en)
- [_Salesforce Help_: Strengthen Your Data’s Security with Shield Platform Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_overview.htm&language=en_US)
- [_Salesforce Help_: Differences Between Classic Encryption and Shield Platform Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_vs_classic_encryption.htm&language=en_US)
- [_Salesforce_: Shield Platform Encryption Architecture](https://resources.docs.salesforce.com/254/latest/en-us/sfdc/pdf/security_shield_platform_encryption.pdf)
- [_Salesforce Help_: Encrypt Data 360 with Customer-Managed Root Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_enable_pe_for_data_cloud.htm&type=5&language=en_US)