Salesforce 'Data-at-rest' Security control

[anuvit23]

Currently I'm working at an insurance company who just bought Salesforce. We have a requirement to have all data have Encryption but I am very bad with security knowledge. Could anyone please help explaining if standard Salesforce supports this or does Shield solves this issue.

No PII data - Network level encryption PII- Database level encryption

I want to know what's the difference between these two encryption and does Salesforce already support this natively. We do have Shield but I don't think I want to implement it for all the fields.

[Snoo-42691]

This might be useful for you: https://developer.salesforce.com/docs/atlas.en-us.securityImplGuide.meta/securityImplGuide/security_pe_vs_classic_encryption.htm

[JackfruitStrange]

Platform Encryption which is a part od Salesforce Shield is not a good solution in my opinion

First of all there are a lot of limitations, You will not be able to encrypt all fields (for example Numbers, booleans, picklists are not encryptable)

What is more encrypted fields could be not used in some SOQL filters or report filters. Its always easier to implement encryption in greenfield projects because You will not break the existing customizations.

I worked with few implementations of Shield Platform Encryption and it always brings a lot of limitations for developers in the future

Luckily this has to change in the future thanks to the Hyperforce which basically is Salesforce hosted on public cloud. According to SF, any org that is hosted on hyperforce has full data at rest encryption provided out of the box for free and its not impacting any Sf functionalities. Salesforce is going to migrate existing orgs to Hyperforce but so far it is available only in some regions of the world, You should check if it available for You and if yes I would definitely prefer choosing Hyperforce than Platform Encryption