FAQ-000550 - Custom Settings and Configuration Security / Specific Use Cases and Implementation Patterns

Here are the security best practices for storing potentially sensitive data in Custom Metadata Types: 1. **Use Protected Custom Metadata Types**: Ensure sensitive data is not exposed by avoiding public visibility for fields containing sensitive information. 2. **Encrypt Sensitive Data**: Encrypt data before storing it, and store the encryption key separately in a protected custom setting or metadata field. 3. **Configure Permissions**: Properly configure permissions for fields with encrypted secrets to prevent unauthorized access. 4. **Avoid Encrypted Fields for Authentication**: Use named credentials or protected custom settings for authentication data instead of encrypted fields. 5. **Restrict Access**: Implement access controls to limit updates or modifications of sensitive data to specific profiles or permission sets. 6. **Use Apex Crypto for Encryption**: Use Apex Crypto calls for encryption and decryption, adhering to enterprise security standards. 7. **Prevent Sensitive Data in Logs**: Avoid writing sensitive data to debug logs or exposing it through the user interface. These practices help protect sensitive data and ensure compliance with security standards.