# Classifying data as Public, Confidential or Secure

*Integration Architect Study Guide · Evaluate Business Needs · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/integration-architect/evaluate-business-needs/classifying-data-as-public-confidential-or-secure*

How to place integration data in the Public, Confidential and Secure tiers, record the tier on each field with Data Sensitivity Level and Compliance Categorization, read it from middleware through FieldDefinition, and turn each tier into concrete controls such as data minimization and mutual TLS.

- Certification: Salesforce Integration Architect
- Exam section: Evaluate Business Needs
- Study guide: https://www.certifyforce.com/study-guide/integration-architect

**Official exam objective:**

> Based on a given integration requirement, identify and classify data into Confidential/Secure/Public.

## What the exam expects

- Place a data element in the Public, Confidential or Secure tier from what it is (published catalog, personal data, regulated identifiers).
- Map each tier to the protection an integration needs, from standard TLS to mutual TLS and exclusion from the payload.
- Record sensitivity and applicable regulations per field with Data Sensitivity Level and Compliance Categorization, and align the picklist to company policy.
- Classify many fields in bulk, and let middleware read classification programmatically.
- Apply data minimization: send only the fields a consumer needs.
- Key terms: **Secure** (the exam's highest, regulated tier; Salesforce's Trust guidance calls it Restricted); **Data Sensitivity Level** (field metadata stored as `SecurityClassification`); **Compliance Categorization** (field metadata naming regulations such as GDPR or PCI); **data dictionary** (catalog of what data you hold and where sensitive data lives); **data minimization** (collect and move only what the purpose needs).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Highest tier examples | PHI, payment data, authentication credentials, SSNs (Restricted = exam's Secure) | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Public tier control | Standard platform TLS in transit | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Restricted data in integrations | TLS 1.2+ enforced by the platform, plus certificate-based mutual authentication you configure | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Granularity | Classify at the field level; one record can hold several tiers | [Trust](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html) |
| Availability | Data classification is in all editions and automatically enabled in all orgs | [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5) |
| Permission to edit | Customize Application or Modify Data Classification | [Data Classification Metadata Fields](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5) |
| API name | Data Sensitivity Level = `SecurityClassification` on FieldDefinition | [Data Classification Metadata Fields](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5) |
| Upload limit | CSV of at most 10,000 rows: object, field, sensitivity level | [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5) |
| Download limits | 5 MB; only fields with a sensitivity value; first 2,000 records per value | [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5) |
| High-risk flag | Mark a Data Sensitivity picklist value as High-risk level | [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5) |
| Email default | Email field has a Confidential default sensitivity value | [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5) |

## Check yourself

- Why is a stored payment card number Secure while customer email is Confidential?
- When does an integration need certificate-based mutual authentication on top of TLS 1.2?
- Which tool classifies 3,000 existing fields at once from Setup?
- Why classify at the field level instead of the object level?

## Sources

- [Trust | Well-Architected](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html)
- [Data Classification Metadata Fields](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5)
- [Set Up Data Classification Metadata](https://help.salesforce.com/s/articleView?id=platform.data_classification_set_up.htm&language=en_US&type=5)
- [Classify Sensitive Data to Support Data Management Policies](https://help.salesforce.com/s/articleView?id=platform.data_classification_intro.htm&type=5)
- [Data Integration with Salesforce](https://architect.salesforce.com/docs/architect/decision-guides/guide/data-integration.html)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams