---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Upload attachments for encryption

# Upload attachments for encryption {#ariaid-title1}

Release version: Australia  
Updated July 28, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Protect sensitive files by encrypting record attachments using Field Encryption and Row Conditions.

## Before you begin

Role required: Any role that aligns with the module access policy (MAP) created by the admin.  
Note:  
Additional setup is required when an email is matched to a record and the matched record's table has an encryption configuration. In this case, the attachments from the email are associated with that record. You need a module access policy (MAP) for the system user. If the sender is matched to a user in your instance, you also need a separate MAP that grants that user access to use the cryptographic module. This MAP is also required to permit impersonation. See [Module access policies for encrypting associated attachments](https://www.servicenow.com/docs/j9WzCQe_E3n6FtD63UgcBg "Encrypting inbound email attachments associated with matched records requires one or more module access policies (MAPs).").  
Important:  
Your administrator must create a separate Encrypted Field Configuration (EFC) for each table where your attachments require encryption. Attachment encryption does not automatically apply to extended (child) tables --- for example, attachments on the incident, case, or problem table will not be encrypted unless a separate configuration is created for each of those tables.

## Procedure

1. Navigate to a record.
2. Select the Manage Attachments paperclip icon.
3. In the Attachments window, select the module to encrypt with from the Encrypt with Module drop-down options.  
   Note:  
   If Row Conditions have been added to the Encryption Field Configuration, this option isn't displayed. The attachment would then be automatically encrypted with the module defined in the Row Condition. Similarly, this drop-down option only displays when using the Manage Attachments icon and not if the attachment is added by dragging and dropping.
4. Select Choose file to locate the attachment and select Open to attach it.

## Result

Attached files display at the top of the form. Encrypted attachments are denoted by a lock icon. Only users with the encryption module to view encrypted files will see them listed.

## What to do next

**Encrypted attachments and missing metadata**

When you encrypt an attachment, the hash and state fields on the sys_attachment record aren't populated. This is by design.

The hash field stores a SHA-256 fingerprint of an attachment's content. Even though a file is encrypted, a hash is a deterministic and stable identifier. The same file produces the same hash value every time. Storing the hash
would enable an attacker who has a copy of the file to confirm that it exists in your system and can weaken encryption.

Because of this, duplicate detection doesn't work for encrypted attachments, since ServiceNow uses the hash field to prevent identical attachments from being added to a record.