Secure your salesforce data with encryption and digital signatures
KeshavMay 2, 2025
In many Salesforce implementations, data security is a top priority. Whether you work with sensitive customer information or internal business secrets, it is necessary to protect data on rest. Salesforce provides strong equipment to handle encryption, and in this blog, we dive into a practical, custom-built example using trigger, Apex crypto methods, and digital signature.
Prerequisites
Before implementing the encryption and digital signature logic, let’s first set up the required custom object Test__c with its fields, and create a self-signed certificate in Salesforce named For_Encryption to be used for signing and verifying data.
Step 1: Create the Custom Object Test__c
1. Navigate to Setup in Salesforce.
2. Under the Object Manager in Setup click Create, then select Custom Object.
3. Name the object Test and set the API Name to Test__c (Salesforce will automatically append __c to the name for custom objects).
4. Ensure the object is "Deployed" so it’s available for use.
5. Check the box for Launch New Custom Tab Wizard after saving this custom object.
6. Optionally, set the Record Name field type to Text or Auto Number, depending on how you want to identify records.
Step 2: Create the Fields on Test__c
Now that the custom object is created, we need to add the following fields:
1. Description (Long Text Area)
1. Navigate to Fields & Relationships on the Test__c object.
2. Click "New" and select the Long Text Area field type.
3. Set the Field Label to Description1 and API Name to Description1__c.
4. Save the field.
2. Description 2 (Long Text Area)
Repeat the same steps to create another Long Text Area field called "Description2", with the API Name Description2__c. This will hold the encrypted and signed data.
3. Checkbox (Checkbox)
Add a Checkbox field with the label "Check Box" and API Name Check_Box__c.
This field will be used to control whether the data should be encrypted or decrypted based on its value.
Step 3: Create a Self-Signed Certificate in Salesforce
To digitally sign data in Apex using the Crypto.signWithCertificate method, you need a certificate stored in Salesforce. Follow these steps to create a self-signed certificate:
1. Navigate to Certificate and Key Management
1. Go to Setup in Salesforce.
2. In the Quick Find box, type Certificate and Key Management.
3. Click on Certificate and Key Management.
2. Create a New Self-Signed Certificate
1. Click Create Self-Signed Certificate.
2. Set the Label as: For Encryption
3. The Unique Name will auto-populate as For_Encryption (this is the API name used in your Apex class).
4. You can leave the key size as default (2048) and use today's date for the expiration.
5. Click Save.
The Goal
We want to automatically encrypt or decrypt a field (Description1__c) on a custom object (Test__c) based on the value of a checkbox field (Check_Box__c). If the checkbox is checked, the field should be encrypted and signed. If it's unchecked, we want to decrypt and verify the signature before restoring the original data.
