---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Exploring Field Encryption

# Exploring Field Encryption {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read  
Learn the details of Field Encryption Starter and Field Encryption Enterprise

## Encryption-backed access control {#exploring-fe__cf-exploring-parent-overview}

By default, Field Encryption blocks all users, scripts, and system processes from accessing encrypted data. However, Field Encryption has an access control feature that works with Access Control Lists (ACLs). This feature ensures only the correct users, scripts, or system processes can access encrypted data.

You can configure Field Encryption access control feature through a combination of Field Encryption Modules, Encrypted Field Configurations, and Module Access Policies. The next image shows how these three components work together.

Module Access Policies (shown in the next image) authorize users, scripts, or system processes to access encrypted data. By default, encrypted data is locked down from any access in the instance.

## Differences between Field Encryption Starter and Field Encryption Enterprise {#exploring-fe__section_bbm_xhn_b2c}

The feature-set is different between Field Encryption Starter and Field Encryption Enterprise.
{#exploring-fe__table_uk2_b3n_b2c__entry__3}

| Feature | Field Encryption Starter | Field Encryption Enterprise |
|-|-|-|
| Number of encrypted fields | Up to 5 encrypted fields | No restriction on number of encrypted fields |
| Attachment encryption | No | Yes |
| Key management | None (Contact ServiceNow Support for key rotation) | Manage keys from your instance with no involvement from ServiceNow Support |
| Supported data types | All supported data types | All supported data types |
| Number of Field Encryption Modules | No restriction | No restriction |
| Number of Module Access Policies | No restriction | No restriction |
| Customer-Supplied Key (BYOK) | No | Yes |
| External Key Management Service (HYOK) | No | Yes |
[Table 1. Feature comparison: Field Encryption Starter vs. Enterprise]

{#exploring-fe__table_uk2_b3n_b2c}

## Field Encryption users {#exploring-fe__cf-exploring-parent-users}

{#exploring-fe__table_k3r_dhn_b2c__entry__2}

| User | Description |
|-|-|
| Key Management Framework (KMF)Admin or KMF Cryptographic Manager | These roles are used to configure elements of Field Encryption. * Field Encryption modules and module keys * Cryptographic Specifications * Module life-cycle policies * Encrypted field configurations for fields and attachments * Module Access Policies (MAPs) * Configures, wraps, and uploads customer supplied keys (for Field Encryption Enterprise) * Configures Access Observer and review Access Observer logs. * Schedule mass encryption, decryption, or re-keying {#exploring-fe__ul_g1h_mvn_b2c} |
| KMF Cryptographic Operator | Configures properties for customer supplied keys |
[Table 2. Users]

{#exploring-fe__table_k3r_dhn_b2c}

## Field Encryption and record history {#exploring-fe__section_pmv_bgy_q2c}

Changes to fields encrypted with Field Encryption are not tracked in the activity stream for the record or in the record history `sys_history_set` table.

## Encryption on system tables {#exploring-fe__section_ph2_xjb_sgc}

Field Encryption currently doesn't support the encryption of fields and attachments of system tables (system tables whose names begin with `sys_`).

## Field Encryption and archive tables {#exploring-fe__section_m3m_bzj_lkc}

Archive tables store historical data from base tables. When you create Encrypted Field Configurations, define them on your base tables, not on archive tables. Encrypted data from base tables automatically moves to archive tables in
an encrypted state. For detailed information on how encryption interacts with archive tables and best practices, see [Archive Tables and Field Encryption](https://www.servicenow.com/docs/KwDSYgkV~3XZm~Lpjmq~XQ "Understand how encrypted data in base tables is handled when it moves to archive tables and get guidelines for properly configuring Encrypted Field Configurations (EFCs).").

## Cloning considerations {#exploring-fe__section_cloning_considerations}

During cloning, encrypted field data and encryption modules are copied to the target instance. Encryption keys are re-encrypted with a secondary key unique to the source instance, so the target instance cannot decrypt the copied field data until key exchange completes.

Until a key exchange is performed, encrypted fields on the cloned instance appear empty or unreadable. This is expected behavior and does not indicate data corruption or loss.

To restore access to encrypted fields on the target instance, complete a key exchange from the source instance. See [Configure Key Exchange](https://www.servicenow.com/docs/T9bDOj5I4w~dnitXCrKx6g "Key Management Framework (KMF) generates automatic key exchange requests for supported cryptographic modules during the fresh installation or upgrade of the instance, and manages the data encryption key locally for the instance.").

## What to explore next {#exploring-fe__cf-exploring-parent-links}

To learn more about configuring and using Field Encryption, see:

* [Configuring Field Encryption](https://www.servicenow.com/docs/hn299vcG_UVn4sSz06RQoQ "Learn how to activate and configure Field Encryption and manage migration from Encryption Support.")
* [Using Field Encryption](https://www.servicenow.com/docs/wcPFSq8m_v5gC46TPI0vUA "Use Field Encryption to manage access to encrypted data on your instances.")
{#exploring-fe__ul_o3r_dhn_b2c}
* **[Field Encryption Enterprise](https://www.servicenow.com/docs/8cW5_VQZZf21dS~eL5yjKQ)**   
  Field Encryption Enterprise uses the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to use Field Encryption Enterprise.