# Encryption, Field Audit Trail and sandbox data masking

*Platform Administrator II Study Guide · Auditing and Monitoring · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-administrator-ii/auditing-and-monitoring/encryption-field-audit-trail-and-sandbox-data-masking*

How to meet a compliance requirement for sensitive data: Field Audit Trail for long-term field history, Shield Platform Encryption (probabilistic or deterministic, with your own keys) alongside field-level security, data classification fields, and Data Mask & Seed for sandboxes.

- Certification: Salesforce Platform Administrator II
- Exam section: Auditing and Monitoring
- Study guide: https://www.certifyforce.com/study-guide/platform-administrator-ii

**Official exam objective:**

> Explain how to ensure sensitive data is set up to support a business/legal/compliance use case in production and sandbox environments.

## What the exam expects

- Choose Field Audit Trail when field history must be kept beyond standard retention, and explain where archived history lives.
- Protect sensitive fields at rest with Shield Platform Encryption, pick probabilistic or deterministic encryption, and pair it with field-level security.
- Label fields with data classification metadata for compliance reporting.
- Keep production data unreadable in sandboxes with Data Mask & Seed (formerly the Data Mask managed package).

Key terms: **Field Audit Trail** (Shield add-on that keeps field history until deleted); **FieldHistoryArchive** (the big object holding archived history); **deterministic encryption** (a scheme that still allows filtering); **tenant secret** (org-specific key material you control); **data masking** (irreversibly replacing sensitive values in a sandbox).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Field Audit Trail licence | Shield or Field Audit Trail; Enterprise, Performance, Unlimited | [Field Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.field_audit_trail.htm&type=5) |
| Default archive age | 18 months in production; one month in sandboxes | [Field Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.field_audit_trail.htm&type=5) |
| Retention policy | HistoryRetentionPolicy, deployed with Metadata API | [Field Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.field_audit_trail.htm&type=5) |
| History storage | Neither tracking nor Field Audit Trail counts against data storage | [Field Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.field_audit_trail.htm&type=5) |
| Encryption trial | Free in Developer Edition; sandboxes only after production is provisioned | [Shield Platform Encryption](https://help.salesforce.com/s/articleView?language=en_US&amp=&id=sf.security_pe_overview.htm) |
| Default scheme | Probabilistic; no filtering on encrypted values | [Deterministic Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_deterministic.htm&language=en_US&type=5) |
| Deterministic options | Case-sensitive or exact-match case-insensitive, per field | [Deterministic Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_deterministic.htm&language=en_US&type=5) |
| Classification fields | All editions; labels only | [Data Classification](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5) |
| Legacy Data Mask | Support ended July 9, 2026; read-only from December 31, 2026 | [Data Mask Retirement](https://help.salesforce.com/s/articleView?id=005299299&language=en_US&type=1) |
| Masking jobs | Sandboxes only; irreversible | [Data Mask (Legacy)](https://help.salesforce.com/s/articleView?id=platform.data_mask_overview.htm&language=en_US&type=5) |

## Check yourself

- Why does an auditor not see three-year-old history on the History related list in an org with Field Audit Trail?
- When does archived field history stay unencrypted after Platform Encryption is turned on?
- Why does filtering on a probabilistically encrypted field fail?
- Which classification field records that a field falls under GDPR?

## Sources

- [Field Audit Trail](https://help.salesforce.com/s/articleView?language=en_US&id=xcloud.field_audit_trail.htm&type=5)
- [Strengthen Your Data's Security with Shield Platform Encryption](https://help.salesforce.com/s/articleView?language=en_US&amp=&id=sf.security_pe_overview.htm)
- [Filter Encrypted Data with Deterministic Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_deterministic.htm&language=en_US&type=5)
- [Data Mask Managed Package Retirement](https://help.salesforce.com/s/articleView?id=005299299&language=en_US&type=1)
- [Secure Your Sandbox Data with Salesforce Data Mask (Legacy)](https://help.salesforce.com/s/articleView?id=platform.data_mask_overview.htm&language=en_US&type=5)
- [Data Classification Metadata Fields](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5)
- [Field History Tracking Overview](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the Platform Administrator II pack (USD $19): https://www.certifyforce.com/practice-exams