---
sourceDocument: Brazil Build or modify applications
sourceDocumentLink: https://www.servicenow.com/docs/r/application-development

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Secure data

# Secure data {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Secure data

Data security is a critical aspect of application development on the ServiceNow AI Platform.
ServiceNow automatically configures access controls when creating tables, restricting access to users with specified roles.
Properly configuring access control rules at both table and column levels ensures that only authorized users can read, create, write, or delete data.
Show full answer Show less  

## Key Features

* **Access Control Lists (ACLs):** Multiple access controls combine to form ACLs that govern table and column-level security. Developers should understand the evaluation order of access controls to effectively protect application data.
* **Role-based access:** Only users assigned the relevant roles can access tables. It is important to restrict table access to minimize unnecessary subscription counts under the Orlando Platform Subscription model, which charges based on table access counts regardless of actual usage.
* **Before-query Business Rules:** These rules run prior to database queries and control read access at the record level. They can hide records without indicating restricted access to users, unlike ACLs. However, they do not replace ACLs and still count towards subscription usage.
* **Performance considerations:** Limit the use of GlideRecord queries within access control scripts as they can impact system performance.
* **Encryption:** The platform offers encryption options at the application, database, and hardware tiers to enhance data security.

## Best Practices

* Protect all relevant components including tables, UI pages, and property pages with appropriate access controls and roles.
* Make auto-populated fields read-only to prevent unauthorized user modifications.
* Configure security early in the application development process to avoid rework and ensure data protection across interfaces and business logic.
* Review existing Business Rules such as the user query Business Rule on the User \[sysuser\] table as references for implementing before-query Business Rules.

## Key Outcomes

By implementing these security measures, ServiceNow customers can ensure that sensitive data is accessible only to authorized users, optimize performance by limiting expensive queries, comply with subscription usage models, and apply encryption layers to protect data integrity and confidentiality.  
Data security is one of the most important and overlooked aspects of creating an application. ServiceNow automatically configures access control for a new or selected role during the table creation process. Only users with the
role can access the table to read, create, write, and delete.

Use access control rules to configure table and column-level security in the ServiceNow AI Platform. To properly configure access to an application, developers should understand how access controls work and the order in which access controls are
evaluated. Apply multiple access controls that together make an Access Control List (ACL).

Self-Paced Training: [Securing Applications](https://developer.servicenow.com/dev.do#!/learn/courses/rome/app_store_learnv2_securingapps_rome_securing_applications)

Documentation: Access control list rules  
When considering security:

* Protect tables, UI pages, property pages, and other content with the appropriate access controls and roles.
* Limit the use of GlideRecord queries in access control scripts. GlideRecord queries can affect performance.
{#secure-data__ul_nkz_53m_sxb}  
Beginning with the Orlando Platform Subscription model, customers are charged by how many tables a user can access, regardless of whether the user does access the table. Configure ACLs to restrict access to a table to ensure that only the users that need access to a table can access the table.  
Note:  
Consider making any auto-populated fields read only. If the system is populating the data, a user should not be able to.

Alternately, secure data on the ServiceNow AI Platform with before-query Business Rules. Before-query Business Rules run before the database query and are limited to controlling read access to a record. Only use before-query Business Rules when
necessary. Some considerations when deciding to use Access Controls or before-query Business Rules:

* GlideRecord queries will bypass read access controls on a table and will be restricted by before-query Business Rules on a table.
* When access controls restrict read access to records in a list, ServiceNow shows a message saying that access has been restricted for the records. With before-query Business Rules, the number of records in the list total matches the number of records shown to the user. The user receives no indication that some records have been hidden from the list.

{#secure-data__ul_lpr_x3m_sxb}  
Review the user query Business Rule on the User \[sys_user\] table for reference.  
Note:  
Before-query Business Rules do not take the place of ACLs. Denying users access to a table via before-query Business Rule will still count the table against the subscription model. Use Access Controls to prevent the table from being counted for the users in the Platform Subscription model.

## Encryption {#secure-data__section_dvj_bjm_sxb}

The ServiceNow AI Platform also provides various encryption solutions at the application tier, database tier, and hardware tier. Learn more in the [Data Encryption Whitepaper](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/white-paper/wp-data-encryption-with-servicenow.pdf).  
Note:  
Set up security before configuring any interfaces or business logic. Since security affects the data available to interfaces and business logic, waiting until the end of the application build process may cause rework and issues.