# Data security, encryption and residency boundaries

*B2C Solution Architect Study Guide · Architecture Design · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/b2c-solution-architect/architecture-design/data-security-encryption-and-residency-boundaries*

How to meet security and residency requirements across Marketing Cloud Personalization and the service org: what beacon self-hosting does and doesn't change, PGP-encrypted ETL files, Sensitive versus Personally Identifiable attributes, and Shield Platform Encryption key choices, rotation, recovery and field limits.

- Certification: Salesforce B2C Solution Architect
- Exam section: Architecture Design
- Study guide: https://www.certifyforce.com/study-guide/b2c-solution-architect

**Official exam objective:**

> Given data security and residency requirements, recommend an appropriate solution and describe how the solution's considerations can impact implementation.

## What the exam expects

- Separate where code is delivered from where customer data is processed when assessing residency.
- Assign customer duties for a self-hosted Personalization beacon.
- Protect Personalization ETL files and sensitive profile values, and know what masking doesn't cover.
- Choose a Shield key-management option and plan rotation, data sync and key recovery.
- Spot fields and features that Shield doesn't encrypt or that need extra steps.

Key terms:
- **JavaScript beacon:** the Personalization script that collects browser behavior and sends it to Personalization servers.
- **Sensitive attribute:** a profile attribute whose value is masked for roles without View Sensitive.
- **Tenant secret:** org-specific Shield key material used to derive data encryption keys.
- **Cache-only key:** customer-held key material that Shield fetches on demand and never persists.
- **Data sync:** the Shield process that applies current encryption policy and key material to existing data.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Self-hosted beacon | No Personalization toggle; customer disables and monitors | [Web Integration Considerations](https://developer.salesforce.com/docs/marketing/personalization/guide/web-integration-considerations.html) |
| Beacon data path | Browser to Personalization servers over SSL | [Sensitive User Information](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_user_information_manage_sensitive.htm&type=5&language=en_US) |
| PGP ETL files | Personalization public key; decrypted only while processing | [Encrypt Sensitive Data](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_etl_integration_encrypt.htm&type=5&language=en_US) |
| Masking | Only Sensitive attributes are hidden | [Sensitive User Information](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_user_information_manage_sensitive.htm&type=5&language=en_US) |
| API tokens | Bypass sensitive restrictions | [Sensitive User Information](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_user_information_manage_sensitive.htm&type=5&language=en_US) |
| Cache-only keys | Never persisted in a system of record or backups | [Cache-Only Key Service](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_byok_cache.htm&type=5&language=en_US) |
| Background encryption | Once every 7 days | [Shield Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&type=5&language=en_US) |
| After key rotation | Deactivate and reactivate custom matching rules | [Shield Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&type=5&language=en_US) |
| Destroyed key material | Data inaccessible unless exported material is imported | [Destroy Key Material](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_destroy_key.htm&type=5&language=en_US) |
| Web-to-Case | Web Company, Web Email, Web Name, Web Phone not encrypted at rest | [Shield Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&type=5&language=en_US) |

## Check yourself

- When must a self-hosted Personalization beacon be refreshed?
- When does Shield's self-service background encryption refuse to run?
- Which key material format does the Cache-Only Key Service accept?

## Sources

- [Web Integration Considerations](https://developer.salesforce.com/docs/marketing/personalization/guide/web-integration-considerations.html)
- [Management of Sensitive User Information](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_user_information_manage_sensitive.htm&type=5&language=en_US)
- [Encrypt Sensitive Data](https://help.salesforce.com/s/articleView?id=mktg.mc_pers_etl_integration_encrypt.htm&type=5&language=en_US)
- [Cache-Only Key Service](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_byok_cache.htm&type=5&language=en_US)
- [General Shield Platform Encryption Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&type=5&language=en_US)
- [Rotate Your Encryption Key Material](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_rotate_keys.htm&type=5&language=en_US)
- [Destroy Key Material](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_destroy_key.htm&type=5&language=en_US)
- [Shield Platform Encryption in Hyperforce](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_hyperforce.htm&type=5&language=en_US)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the B2C Solution Architect pack (USD $19): https://www.certifyforce.com/practice-exams