---
schema_version: "1"
id: debbd82e1ae280c4402d8a0bd3d2a3903853411e0aa1b25a228b5edcd14d3c47
title: Set Up Platform Encryption for Data 360
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/data/264-0-0/c360_a_setup_platform_encryption_data_cloud.md
canonical_url: https://help.salesforce.com/s/articleView?id=data.c360_a_setup_platform_encryption_data_cloud.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5c19301765876022e609dfa13e50dc9b1391f92249638d4d2563c93b48a84893
description: When you enable Platform Encryption, your first Data 360 root key generates automatically. This key encrypts all previously ingested data in Data 360. After the initial setup, you can continue to use the generated root key or configure an external key using External Key Management (EKM), or leverage your own key material using Bring Your Own Key (BYOK) in the Salesforce UI to encrypt data in Data 360. You can rotate root keys periodically and view key metadata, such as creation time and creator, in Setup.
products:
  - Data 360
release: "264"
---
# Set Up Platform Encryption for Data 360

When you enable Platform Encryption, your first Data 360 root key generates automatically. This key encrypts all previously ingested data in Data 360. After the initial setup, you can continue to use the generated root key or configure an external key using External Key Management (EKM), or leverage your own key material using Bring Your Own Key (BYOK) in the Salesforce UI to encrypt data in Data 360. You can rotate root keys periodically and view key metadata, such as creation time and creator, in Setup.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All Editions</strong> supported by Data 360. See <a href="https://help.salesforce.com/s/articleView?id=data.c360_a_dc_editions.htm&amp;language=en_US&amp;type=5l" target="_blank">Data 360 edition availability</a>.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available with add-on license: <strong>Enterprise</strong>, <strong>Performance</strong>, <strong>Unlimited</strong>, and <strong>Developer</strong> Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and Platform Encryption for Data Cloud. Also, to use the optional External Key Management, requires purchasing the Platform Encryption for Consumption license.</td></tr></tbody></table>

Here are the key migration options.

- From Customer Managed Keys (CMK) to EKM: Existing CMK customers can configure a new EKM key from the Key Inventory and Management page in Setup. This change affects only the encryption of new data going forward. Previously encrypted data remains encrypted with the existing CMK key.
- From EKM to CMK: Existing EKM customers can switch to a CMK by generating a new key in the Key Inventory and Management page. This action reencrypts existing Data 360 data using the newly generated CMK key.
- From CMK or EKM to BYOK: Upload your own key material via the Bring Your Own Key option in Setup. Data encrypted with previous keys remains accessible. The new data is encrypted using the new BYOK root key.
    - Customers can transition from CMK to BYOK and BYOK to CMK via the Salesforce UI. When this transition occurs we don’t reencrypt previously ingested data to the new key. It stays encrypted with the previous key.
    - Customers can also transition from EKM to BYOK and BYOK to EKM.
        - From EKM to BYOK: We reencrypt all previously ingested data to the new key.
        - From BYOK to EKM: When this transition occurs we don’t reencrypt previously ingested data to the new key. It stays encrypted with the previous key.