Backup data presents the same compliance and security risks as live data. Protect your data backups with Shield Platform Encryption for Backup & Recover Next. Encrypt backups with tenant-specific root keys that you control. These root keys secure and control the data encryption keys used to encrypt backups at rest. You can generate a root key in Setup, use Bring Your Own Key (BYOK) to upload a key, and rotate root keys.
Where: This change applies to Lightning Experience in Enterprise, Performance, Unlimited, and Developer editions with the Salesforce Shield or Shield Platform Encryption add-on license and Backup & Recover enabled.
When: Shield Platform Encryption for Backup & Recover Next is available starting in July 2026.
How: When enabling backups in the Backup & Recover app, click Go to Platform Encryption. You can also go directly to the Encryption Settings page in Setup. Turn on Manage Backup & Recover Keys. Salesforce generates a root key for you. All backups made after your key is activated are encrypted. Backups that existed before your first key is activated aren’t encrypted. If you’re new to Backup & Recover Next and haven’t backed up data yet, we recommend that you create a root key first before backing up data.