Skip to main content
This document provides information on configuring Futurex Hardware Security Modules (HSMs) with Salesforce Bring Your Own Key (BYOK) using Futurex Excrypt Manager. For additional questions related to your HSM, see the relevant user guide.

​
What is Salesforce?

“Salesforce is the world’s leading customer relationship management technology, helping you build and improve your customer relationships. Our Starter Suite makes it easy for small businesses to get organized and grow with the #1 AI CRM. And we’re helping organizations of all sizes unify their data and re-imagine their business for the world of AI with Agentforce, providing autonomous AI agents that take action for your employees and customers.” Link to their products page Beyond core CRM functionality, Salesforce includes a broad ecosystem of products such as:
  • Sales Cloud
  • Service Cloud
  • Marketing Cloud
  • Platform Services (including the Salesforce AppExchange).
These enable organizations to extend their capabilities through custom applications, integrations, and third-party solutions. For security-focused deployments, Salesforce supports BYOK using Shield Platform Encryption. BYOK allows organizations to maintain control over their data encryption keys by managing those keys externally, such as with a Vectera Plus HSM, and securely providing a wrapped tenant secret to Salesforce. This ensures that encrypted data in Salesforce is protected by keys fully controlled by the customer.

​
What is BYOK?

“When you supply your own tenant secret or data encryption key (DEK), you get the benefits built into Salesforce Shield Platform Encryption, plus the extra assurance that comes from exclusively managing your own key material. Depending on the feature, BYOK supports derived keys and DEKs. To be compatible with Salesforce BYOK, use a PKCS#8 encrypted, Base64 encoded 4096 RSA key pair with appropriate headers and footers.” Link to their help documentation on BYOK

​
Using the HSM for BYOK integration

​
Using the HSM for Salesforce BYOK

Salesforce BYOK allows customers to control the encryption keys that protect their data. In this integration, the AES-256 tenant secret is generated externally, while the HSM is used to securely manage and wrap the key using Salesforce’s public RSA key. By leveraging the HSM, organizations can maintain full control over their tenant secrets and upload them to Salesforce.

​
Guardian integration

The Guardian Series 3 introduces mission-critical viability to core cryptographic infrastructure, including:
  • Centralization of device management
  • Elimination of points of failure
  • Distribution of transaction loads
  • Group-specific function blocking
  • User-defined grouping systems
See the applicable guide in the Futurex Portal for configuring HSMs with the Guardian Series 3, including PKCS #11 and CNG configuration.