---
schema_version: "1"
id: ce0dca625909874659af2439207e7ceacaa2fca6649916fd49a7b239a1a32300
title: Field-Level Encryption Limits
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_field_level_encryption_limitiations.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_field_level_encryption_limitiations.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2871f9cdff55fe2c68750af8b55a0681b9e02f27b18382fa5af43a183030aa1d
description: Learn about the limits apply to field-level encryption in the security and encryption components of Marketing Cloud Engagement.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Field-Level Encryption Limits

Learn about the limits apply to field-level encryption in the security and encryption components of Marketing Cloud Engagement.

- Use only data extensions created specifically for field-level encryption with this feature.
- Configure field-level encryption before you configure processes that synchronize data with Sales Cloud or Service Cloud.
- After you turn on field-level encryption, you can’t segment, filter, or query encrypted fields.
- Encrypted data appears encrypted on Discover and standard reports. The `send-to` domain appears as @exct.net.
- Field-level encryption doesn’t support auto-suppression lists. Instead, create a list that contains the subscriber key values to suppress and assign that list for use in your account.
- You can’t add or update encrypted data through the Marketing Cloud Engagement web interface. Use imports, AMPscript, triggered sends, or API calls. You can also use Contact Builder to add records to a data extension manually.
- Field-level encryption doesn’t support encryption of a mobile number used as a subscriber key value.
- Field-level encryption doesn’t support encryption of primary key fields or subscriber key values.
- MobileConnect and MobilePush messages can’t include encrypted fields.
- After you turn on field-level encryption, you can’t turn it off.
- Field-level encryption doesn’t support list-based sending.
- Accounts that use field-level encryption don’t support data filters. Use query activities instead.
- Data relationships don’t support field-level encryption. Use queries instead of data relationships in accounts with field-level encryption enabled.
- Encrypted fields within data extensions don’t support default values.
- API-based triggered sends support encryption only for email addresses. Triggered sends don’t decrypt other fields in the email body.
- If you include the `emailaddr` personalization string in your email messages, send logs contain the unencrypted email address. If you share a log with people who aren’t authorized to view these addresses, manually remove them from the logs before sending.
- The Transactional Messaging API in Marketing Cloud Engagement doesn’t support field-level encryption.
- After you turn on field-level encryption, you can’t use High-Throughput Sending in Journey Builder. See [Journey Builder High-Throughput Sending Considerations](https://help.salesforce.com/s/articleView?id=mktg.mc_jb_high_throughput_sending.htm&language=en_US).