FAQ-000723 - Data Storage and Encryption Security / Secure Storage Best Practices

Current Status:VALID_RESPONSEErrorUnable to AnswerSuggests Case

Current FAQ

Question
How can I securely store credentials or other sensitive data within my application?
Answer
To securely store credentials or other sensitive data within your application, follow these best practices: 1. **Protected Custom Settings**: Use these to store sensitive data securely. They are inaccessible to external packages or untrusted code. Create a custom UI for users to input and update credentials, which are then securely stored via an Apex class. 2. **Named Credentials**: Use these for metadata and configuration that need to be packaged. Note that administrators can view these credentials, so they are best for locally generated or per-organization secrets. 3. **Encryption with Custom Objects**: If using custom objects, encrypt sensitive data with Apex Crypto calls. Store the encryption key in a protected custom setting or hidden custom metadata API field. Set proper permissions for encrypted fields. 4. **Vendor-Supplied Keystores**: For client applications, use vendor-provided keystores (e.g., keychain for Mac, DP-API for Windows). For server applications, encrypt credentials with AES-128 or higher and store the encryption key securely, separate from the database layer. 5. **Avoid Public Storage**: Do not store sensitive data in public custom settings, metadata, or unencrypted fields. Ensure sensitive data is not logged or exposed in debug statements. These methods help ensure sensitive data is stored securely and align with application security best practices.
Enhancing FAQ...

Enhancing FAQ with AI recommendations...

AI Recommended Enhancement

Related Security Rules (click to view)
ApexBadCryptoApexSuggestUsingNamedCredAvoidHardcodedCredentialsInFieldDeclsAvoidHardcodedCredentialsInHttpHeaderAvoidHardcodedCredentialsInVarAssignAvoidHardcodedCredentialsInVarDeclsProtectSensitiveData
Question
How can I securely store credentials or other sensitive data within my application?
Recommended Answer Update
To securely store credentials or other sensitive data within your application, follow these best practices: 1. **Protected Custom Settings**: Use these to store sensitive data securely. They're inaccessible to external packages or untrusted code. Create a custom UI for users to input and update credentials, which are then securely stored via an Apex class. 2. **Named Credentials**: Use these for metadata and configuration that need to be packaged. Note that administrators can view these credentials, so they're best for locally generated or per-organization secrets. 3. **Encryption with Custom Objects**: If using custom objects, encrypt sensitive data with Apex Crypto calls. Store the encryption key in a protected custom setting or hidden custom metadata API field. Set proper permissions for encrypted fields. 4. **Vendor-Supplied Keystores**: For client applications, use vendor-provided keystores (e.g., keychain for Mac, DP-API for Windows). For server applications, encrypt credentials with AES-128 or higher and store the encryption key securely, separate from the database layer. 5. **Avoid Public Storage**: Don't store sensitive data in public custom settings, metadata, or unencrypted fields. Ensure sensitive data isn't logged or exposed in debug statements. These methods help ensure sensitive data is stored securely and align with application security best practices.
Reasoning
The recommendations improve clarity and tone by making the language more conversational and direct, following the brand guidelines. Changed 'Do not store' to 'Don't store' and 'are not logged' to 'isn't logged' for better conversational flow. Used contractions throughout to sound more natural and approachable while maintaining all technical accuracy. All security rules selected are directly relevant: ApexBadCrypto relates to the encryption guidance in point 3 about using Apex Crypto calls properly; ApexSuggestUsingNamedCred directly relates to point 2 about using Named Credentials; AvoidHardcodedCredentialsInFieldDecls, AvoidHardcodedCredentialsInHttpHeader, AvoidHardcodedCredentialsInVarAssign, and AvoidHardcodedCredentialsInVarDecls all relate to point 5's guidance about avoiding public storage of credentials and not hardcoding them; ProtectSensitiveData broadly applies to the entire FAQ's focus on securely storing sensitive information and credentials.
Reasoning References