---
schema_version: "1"
id: a0429c4929dafed3088aa7e69a65ad130c3aa466b932077a792ed4173c83965c
title: Security Considerations for Flows
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/flow_considerations_salesforce_features_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.flow_considerations_salesforce_features_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d21285791cc89de94633112387204597063e8fc60ae52cd6c34797cbc509f229
description: When designing flows, keep these security considerations in mind.
products:
  - Flow Builder
  - Salesforce Platform
release: "264"
---
# Security Considerations for Flows

When designing flows, keep these security considerations in mind.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=platform.flow_ref_supported_editions.htm&amp;release=264.0.0&amp;type=5" title="Learn about the editions and user interfaces that support Flow Builder. Some Flow Builder features integrate with other Salesforce products that require additional licenses.">View supported editions.</a></td></tr></tbody></table>

## Flow Interviews

When a user session expires, Salesforce interrupts in-progress flow interviews, and users can’t resume them. If the flow ran actions, such as a Create Records or Post to Chatter element, Salesforce doesn’t roll back those actions. But the interview loses other progress, such as what the user entered on the screen.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-platform_automation-264-0-0-production-enus/60568438-ec7e-4665-acd1-7c80dcbe60d5/images/icon_tip.png)

Tip

- Set your session timeout settings to log out users after an appropriate period.
- Encourage your users to pay attention during interviews for alerts about their sessions expiring soon.
- Remind users to avoid running flows during release upgrades. A typical upgrade takes about 5 minutes.

Expired user sessions don’t affect paused or waiting flow interviews.

## Shield Platform Encryption

You can’t filter or sort records by encrypted fields for these elements and resources.

- Update Records element
- Delete Records element
- Get Records element
- Record Choice Set resource

## Screen Flow Inputs

For enhanced security, remove all HTML from publicly accessible input fields in screen flows. For example, an input field on a publicly accessible screen flow maps to a rich text field in Salesforce. To prevent a malicious URL from accessing the rich text field, create a separate flow on the object to strip out the HTML. Optimize the new flow for fast field updates, and set it to run whenever the input field isn’t blank. Because several sources can write to a publicly accessible input field, check for HTML at the field level and not at the screen level.

You can also use an existing Apex trigger on the object to strip out the HTML.

## Custom Metadata Types and Custom Settings

Flows can read public custom metadata types and custom settings regardless of the running user’s permissions, whether the flow runs in user context or system context.

In flows that run on API version 64.0 and later, a screen can show fields from custom metadata type records and custom setting records that a Get Records element retrieves. The screen shows these fields even when the running user doesn’t have access to them. In flows that run on API version 63.0 and earlier, the screen returns an error for those fields when the running user lacks access to them.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-platform_automation-264-0-0-production-enus/60568438-ec7e-4665-acd1-7c80dcbe60d5/images/icon_important.png)

Important Don’t store sensitive information in public custom metadata types or custom settings that you retrieve in a screen flow.

#### See Also

- [Modify Session Security Settings](https://help.salesforce.com/s/articleView?id=xcloud.admin_sessions.htm&language=en_US)