# Encryption, Event Monitoring and transaction security policies

*Platform Sharing and Visibility Architect Study Guide · Permissions to Standard Objects, Custom Objects, and Fields · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect/permissions-to-standard-objects-custom-objects-and-fields/encryption-event-monitoring-and-transaction-security-policies*

How to layer controls around PCI, PII and HIPAA data: data classification labels, Classic Encryption with masking, Shield Platform Encryption schemes and their tradeoffs, Event Monitoring and field history for evidence, and transaction security policies that block risky activity in real time.

- Certification: Salesforce Platform Sharing and Visibility Architect
- Exam section: Permissions to Standard Objects, Custom Objects, and Fields
- Study guide: https://www.certifyforce.com/study-guide/platform-sharing-and-visibility-architect

**Official exam objective:**

> Given a scenario, determine the appropriate access controls to protect sensitive data (e.g. PCI, PII, or HIPAA).

## What the exam expects

- Combine controls for sensitive data: who may read it (field-level security, sharing), how it is stored (encryption), and what evidence and real-time enforcement exist (Event Monitoring, transaction security).
- Choose between Classic Encryption and Shield Platform Encryption, and between probabilistic and deterministic schemes, given filtering, uniqueness and licence constraints.
- Predict encryption tradeoffs: criteria-based sharing rules, sorting, unencrypted copies, field types that can't be encrypted.
- Pick Event Monitoring over field history when the question is who viewed data, and a transaction security policy when activity must be stopped as it happens.
- Explain what protects data in transit, at rest and once it leaves Salesforce.

Key terms: **data classification** (sensitivity and compliance labels on fields); **Classic Encryption** (encrypted custom text fields with masking); **Shield Platform Encryption** (encryption at rest by Database Encryption or field-level encryption); **deterministic encryption** (scheme that keeps encrypted data filterable); **transaction security policy** (conditions on a real-time event plus an action).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Encryption isn't authorization | Use field-level security and sharing to control who sees data | [Shield Platform Encryption Best Practices](https://help.salesforce.com/s/articleView?id=sf.security_pe_best_practices.htm&language=en_US&type=5) |
| Shield licence | Enterprise, Performance, Unlimited with Shield or Shield Platform Encryption; free in Developer | [Shield Platform Encryption overview](https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm&language=en_US&type=5) |
| Deterministic scheme | Supports WHERE clauses, unique and External ID fields | [Filter Encrypted Data with Deterministic Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_deterministic.htm&language=en_US&type=5) |
| Sharing rules | Encrypted fields can't be used in criteria-based sharing rules | [General Shield Platform Encryption Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&language=en_US&type=5) |
| Field types | Currency and Number fields can't be encrypted | [Shield Platform Encryption Best Practices](https://help.salesforce.com/s/articleView?id=sf.security_pe_best_practices.htm&language=en_US&type=5) |
| Classic field length | Encrypted text fields limited to 175 characters | [Classic Encryption for Custom Fields](https://help.salesforce.com/s/articleView?id=sf.fields_about_encrypted_fields.htm&language=en_US&type=5) |
| Field history retention | 18 months (24 via API) without Field Audit Trail | [Field History Tracking Overview](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5) |
| Policy permissions | Customize Application and Modify Transaction Security Policy | [Build a Transaction Security Policy with Condition Builder](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_condition_builder.htm&language=en_US&type=5) |

## Check yourself

- Why can't a Classic encrypted text field serve as an upsert key?
- When can encrypted values end up stored unencrypted?
- Which feature answers "who viewed this data and from where"?
- Why do partner users with View Encrypted Data still not see a Classic encrypted field?

## Sources

- [Shield Platform Encryption Best Practices](https://help.salesforce.com/s/articleView?id=sf.security_pe_best_practices.htm&language=en_US&type=5)
- [Strengthen Your Data's Security with Shield Platform Encryption](https://help.salesforce.com/s/articleView?id=sf.security_pe_overview.htm&language=en_US&type=5)
- [General Shield Platform Encryption Considerations](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_considerations_general.htm&language=en_US&type=5)
- [Filter Encrypted Data with Deterministic Encryption](https://help.salesforce.com/s/articleView?id=xcloud.security_pe_deterministic.htm&language=en_US&type=5)
- [Classic Encryption for Custom Fields](https://help.salesforce.com/s/articleView?id=sf.fields_about_encrypted_fields.htm&language=en_US&type=5)
- [Classify Sensitive Data to Support Data Management Policies](https://help.salesforce.com/s/articleView?id=platform.data_classification_intro.htm&language=en_US&type=5)
- [Data Classification Metadata Fields](https://help.salesforce.com/s/articleView?id=platform.data_classification_metadata_fields.htm&language=en_US&type=5)
- [Event Monitoring](https://help.salesforce.com/s/articleView?id=xcloud.real_time_event_monitoring_overview.htm&language=en_US&type=5)
- [Field History Tracking Overview](https://help.salesforce.com/s/articleView?id=xcloud.tracking_field_history.htm&language=en_US&type=5)
- [Transaction Security](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_policy_types.htm&language=en_US&type=5)
- [Build a Transaction Security Policy with Condition Builder](https://help.salesforce.com/s/articleView?id=xcloud.enhanced_transaction_security_condition_builder.htm&language=en_US&type=5)
- [Encrypt Your Entire Database (Beta/Sandbox Release)](https://help.salesforce.com/s/articleView?id=release-notes.rn_256_security_pe_de_sandbox.htm&language=en_US&release=256&type=5)
- [Trust | Salesforce Well-Architected](https://architect.salesforce.com/docs/architect/well-architected/guide/trust.html)
- [Integrate Salesforce with Heroku via Heroku Connect (Trailhead)](https://trailhead.salesforce.com/content/learn/modules/salesforce_heroku_integration/integrating_with_heroku_connect)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 19 linked practice questions, and unlimited timed mock exams are included with the Platform Sharing and Visibility Architect pack (USD $19): https://www.certifyforce.com/practice-exams