https://www.sikich.com

Protect Your Sandbox with Salesforce Data Mask

Tim Bauman

Apr 6 2020

3 min read

Announced at Dreamforce 2019, Salesforce has made it much easier to secure the sensitive information in your organization when working in sandboxes. The new Data Mask resource allows an administrator to select different fields to alter using different methods depending on how the data will be used in the lower environment. Since many sandbox users are not production users or do not need access to the actual information, this functionality provides a simplified (and irreversible) way to make it unreadable or unrecognizable.

Why would this be necessary?

Many industries, such as financial services, have strict regulatory requirements to protect the data of their clients. Imagine a large-scale implementation of Salesforce at an institution like this. Technologists, consultants, etc. who are not in the “need to know” category regarding the customers’ specific data points can still perform their responsibilities with dummy information. This provides the opportunity to minimize the risk of data breach, monetary penalties, and—most often, the costliest result—reputational impact.

What are my options?

Data to mask:

Salesforce supports the masking of almost any field type, except for checkboxes, lookups, and picklists. It is recommended to scramble or randomize the values of any field with personal information (PI) or personally identifiable information (PII). This includes data points such as names, addresses, contact information, SSNs/EINs, birthdates, etc. for both individuals and entities.

Levels of masking:

Pseudonymization allows you to replace actual values with values that still make logical sense but are entirely unrelated to the original source. For instance, if you have a customer John Doe with email jdoe@gmail.com, Data Mask will change the information to something along the lines of Amy Smith with email gary.wilson@creativewooddesign123.com.

Anonymization means that your data will be scrambled into complete and utter nonsense where applicable. Names may end up turning into a string such as “oi@#siRF,” but since an email address requires a specific format, you will receive values like the pseudonym email above.

Deletion is an option when sensitive data is not essential to a sandbox. You can take any given field and convert its values to an empty set, so that no information will be stored at all. Take caution with deciding to delete, however, as this cannot be undone in a sandbox.

Additional Considerations

Data Mask requires the installation of a Managed Package in Lightning Experience. You can choose from configuring the mask in production or an individual sandbox based on your needs, but the actual job is run from a sandbox. Finally, many of the duplicate, workflow, and validation rules that exist in a lower environment are bypassed or disabled to allow masking completion.

Have any questions about Data Mask or Salesforce in general? Please contact us at any time!

This publication contains general information only and Sikich is not, by means of this publication, rendering accounting, business, financial, investment, legal, tax, or any other professional advice or services. This publication is not a substitute for such professional advice or services, nor should you use it as a basis for any decision, action or omission that may affect you or your business. Before making any decision, taking any action or omitting an action that may affect you or your business, you should consult a qualified professional advisor. In addition, this publication may contain certain content generated by an artificial intelligence (AI) language model. You acknowledge that Sikich shall not be responsible for any loss sustained by you or any person who relies on this publication.

About the Author

Tim Bauman

Tim Bauman is a Salesforce consultant within the technology practice at Sikich. Tim works with clients to analyze, design, build, test, deploy and support their Salesforce implementation. He serves businesses and individuals in a number of industries, with over five years of experience specializing in the financial services industry. Outside of the office, you can find Tim hiking and photo-documenting his adventures.