---
schema_version: "1"
id: c9d69d1d6c95f304e538b4e360c054558ba194bfce8d72cc6b5d8431078d2677
title: Root Key Lifecycle
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_root_key_lifecycle.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_root_key_lifecycle.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b86398c33c9089a1c7503a6515eddfbc9c044a5366db6b41253cc01ba4259c0b
description: Root key statuses in Platform Encryption define the usage of each key for data encryption and decryption.
products:
  - Data 360
release: "264"
---
# Root Key Lifecycle

Root key statuses in Platform Encryption define the usage of each key for data encryption and decryption.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;language=en_US&amp;type=5l" target="_blank">Data 360 edition availability</a>.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with add-on license: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and Platform Encryption for Data Cloud. Also, to use the optional External Key Management, requires purchasing the Platform Encryption for Consumption license.</td></tr></tbody></table>

Each status impacts the key's availability and functionality within the encryption lifecycle.

- Active: The root key is visible in the Salesforce Platform Encryption UI and encrypts new data. All write options use this key to ingest new data from this point forward. Only one root key can be active at a time.
- Archived: When a new root key is generated, the previous key is archived. Archived keys remain available for decrypting existing data but aren't used for encryption of new data.
- Inactive: A root key becomes inactive when manually deactivated in the Salesforce Platform Encryption UI. In this state, the root key is no longer usable for encryption or decryption. Data encrypted with this key is inaccessible until the key is reactivated through the Salesforce UI.
- Unavailable (EKM only): This status applies only when using External Key Management (EKM). A root key becomes unavailable when it’s deactivated in the external key manager, such as AWS KMS. This status behaves similarly to Inactive. Before Data 360 processes start failing, customers get notified by email.
- Cancelled: Key is abandoned explicitly. This allows customer to generate a different key.

To reactivate the inactive or unavailable keys, see [Reactivate an EKM Key](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_ekm_reactivate_an_ekm_key.htm&language=en_US&type=5). Reactivate the key within 48 hours to avoid data loss in Data 360.

## Key States for BYOK

- Pending Setup completion: Salesforce has created the empty key wrapper in AWS KMS, and the system is waiting for you to upload the wrapped key material and token.
- Active: The key is active and its identifier appears in the UI.
- Archived: The key is archived after you generate a new root key. Archived keys can decrypt existing data but can’t encrypt new data. Decryption continues to work as soon as the key enters the archived state.
- Inactive: The key becomes inactive when you deactivate it in the Salesforce UI. Inactive keys can’t encrypt or decrypt data. Any data encrypted with this key becomes inaccessible until you reactivate it.
- Cancelled: You explicitly canceled the key. After cancellation, you can generate a new key.

#### See Also

- [_Salesforce Help_: Reactivate an EKM Key](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_ekm_reactivate_an_ekm_key.htm&language=en_US)
- [_Salesforce Help_: Check the Connection to Your EKM Key](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_ekm_check_connection.htm&language=en_US)