---
schema_version: "1"
id: 8eb8680997917e59b3c8402dbbcd02d760a56e8f66f4e982d3db2bec9e7262e8
title: Shield Platform Encryption
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_security_pe.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_pe.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 5a8c43b70ecc951e4f1382c6fde99c0d495c4a6f8f66a244a83ddef8c80c9f8a
description: Reduce friction in the encryption process with Database Encryption, now generally available in all regions. Bring Your Own Key for Data 360 opens more root key management options.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Shield Platform Encryption

Reduce friction in the encryption process with Database Encryption, now generally available in all regions. Bring Your Own Key for Data 360 opens more root key management options.

- **[Encrypt Your Entire Database (GA Release)](https://help.salesforce.com/s/articleView?id=release-notes.rn_260_security_pe_de_ga.htm&release=260&type=5)**  
    Database Encryption is generally available worldwide. It began its deployment in Winter '26. Due to the pace of the controlled release, some regions lagged in enabling the new feature. Database Encryption allows you to sort, filter and reference encrypted data without functional or performance tradeoffs. You can still apply Field Level Encryption to individual fields if required.
- **[Bring Your Own Key to Data 360](https://help.salesforce.com/s/articleView?id=release-notes.rn_260_security_pe_dc_byok.htm&release=260&type=5)**  
    Platform Encryption for Data 360 customers can now make use of the Bring Your Own Key (BYOK) feature of Shield Platform Encryption. When you supply your own root key, you get the benefits built into Salesforce Shield Platform Encryption, plus the extra assurance that comes from exclusively managing your own key material. For Data 360, BYOK supports root keys only. Data 360 then manages all DEK creation and wrapping using the root key. To be compatible with Salesforce BYOK, use a PKCS#8 encrypted, Base64 encoded 4096 RSA key pair with appropriate headers and footers.
- **[Encrypt Newly Supported Fields with Shield Platform Encryption](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_pe_encrypt_new_fields.htm&release=260&type=5)**  
    You can now encrypt the Comments field on these objects: Business Operations Process Participant, Compliance Control Participant, Compliance Policy Participant, Validation Procedure Participant, Financial Account Participant, and Regulation Participant. On the Case object, you can encrypt the Rich Text Area for Case Description field. On the Provider Activity Goal Limit object, you can encrypt the Source System Identifier field.