Overview
DuoKey for Salesforce BYOK
Secure your Salesforce data with customer-managed encryption keys
The Salesforce Shield integration is in preview and is not yet enabled on standard DuoKey Cockpit tenants. This guide describes how it works and how it is set up. Contact DuoKey to discuss access for your project.
Architecture
Salesforce Shield with a DuoKey key
Salesforce Shield keeps the data; DuoKey keeps the key in your vault or HSM. Revoke the key and the encrypted data goes dark.
What is Salesforce BYOK?
DuoKey for Salesforce BYOK (Bring Your Own Key) provides a comprehensive solution for securing your Salesforce data with customer-managed encryption keys. This integration enables organizations to maintain complete control over their encryption keys while leveraging Salesforce's Shield Platform Encryption.
Complete Key Control
Manage encryption keys through DuoKey's centralized platform
Cache-Only Keys
Keys remain in memory, never persisted in Salesforce
Automated Management
Simplified key creation, rotation, and revocation
Compliance Ready
Meet regulatory requirements for key management
Shield Platform Encryption Options
| Option | Key Location | Control Level | Best For |
|---|---|---|---|
| Salesforce-Generated | Salesforce HSMs | Standard | Basic encryption needs |
| BYOK | Uploaded to Salesforce | Enhanced | Balance of control and simplicity |
| External Key Management | External KMS | Maximum | Strict compliance requirements |
| Cache-Only Keys | Memory only | Maximum | Keys never stored in Salesforce |
How It Works
Layer stack
Salesforce BYOK key layers
The Shield data key is wrapped by your DuoKey root key, which is held as MPC key shares so the full root key never exists in one place. Keys are unwrapped on demand and never persisted in Salesforce.
Key Features
Key Control
Full control of encryption keys outside Salesforce
Cache-Only Service
Keys in memory only, never persisted
Key Lifecycle
Automated creation, rotation, revocation
RBAC
Granular role-based access control
Audit Logging
Comprehensive compliance logging
REST API
Seamless Salesforce integration
Use Cases
Data Residency
Maintain encryption keys in your preferred geographic location while using Salesforce's global infrastructure.
Regulatory Compliance
Meet GDPR, HIPAA, and other regulations requiring customer-controlled encryption keys.
Enhanced Security
Implement defense-in-depth by separating key management from data storage.
Multi-Cloud Strategy
Integrate Salesforce protection into your broader multi-cloud security strategy.
Prerequisites
Prerequisites
- Salesforce Developer Edition Account or higher
- DuoKey platform access
- Admin permissions in both platforms
- Understanding of Salesforce Shield Platform Encryption
- Basic knowledge of REST API integration
Getting Started
Getting Started
Initial setup and prerequisites
Prerequisites
Configure Salesforce environment
Create App
Set up DuoKey integration