Salesforce Shield is worth it when you hold sensitive data and have a specific need that your standard setup can't meet, such as long-term field history, encryption at rest or detailed activity logs. It is not worth buying as a general security upgrade. Many orgs get more risk reduction from fixing permissions and sharing first, and Shield does not do that for you.
Below is what Shield includes, what you can already do without it, and how to decide. Salesforce details were checked against Salesforce's own pages in November 2026. We do not quote prices here: Salesforce says Shield pricing varies by edition and user count, so ask your account executive for a current quote.
What Shield includes
Salesforce's Shield guide lists four products (Salesforce, Shield guide, checked November 2026):
- Platform Encryption: field-level encryption at rest using AES 256-bit, for standard and custom fields plus files and attachments. It supports bring your own key.
- Field Audit Trail: a record of changes to fields by user, time and content, kept for compliance and internal audits.
- Event Monitoring: logs of user and API activity so you can spot suspicious behavior, with support for alerts and SIEM integration.
- Data Detect: scans your org for sensitive data such as personal identifiers and financial details, and classifies what it finds.
You may be able to license pieces separately, and what is available to you depends on your contract. That is a question for Salesforce, not something we can answer from the outside.
Event Monitoring: who did what
Event Monitoring records activity such as logins, logouts, API calls, Apex executions and report exports. Salesforce's Trailhead says it covers at least 50 event types, stored as event log files (Trailhead, Event Monitoring, checked November 2026). Salesforce's Shield page puts the number higher, so treat it as "dozens of event types" and check the current list for your org.
What you get without paying: Trailhead says Enterprise, Unlimited and Performance orgs get free access to a handful of logs (Login, Logout, API Total Usage and a few error and policy logs), with one day of retention. Paid access extends retention for some log types up to one year, and files become available after 24 hours for everyone and hourly for Event Monitoring customers.
Good fit if you need to answer "who exported that report?" or "was this account used from somewhere unusual?" after the fact, or you want to feed activity into a security monitoring tool.
Poor fit if nobody will look at the logs. Data nobody reviews is a cost, not a control. Decide who watches it and what they do when something looks wrong.
Field Audit Trail: long memory for changes
Standard field history tracking is free and fine for many teams. Salesforce's developer documentation lists up to 20 tracked fields per object and a retention window of 18 to 24 months (about 18 months in the interface, up to 24 through the API) (Salesforce Developers, Field Audit Trail, checked November 2026).
Field Audit Trail extends that. Salesforce's Shield guide says you can retain field history for anywhere from one to ten years.
Good fit if a funder, regulator or contract requires you to show how a specific value changed years ago, for example a client's eligibility status, a consent flag or an amount. Think of it as proof of history, not day-to-day reporting.
Poor fit if your real need is "what changed last week." Standard history tracking, or a flow that logs key changes, often covers that.
Platform Encryption: protecting data at rest
Encryption at rest protects the data as it is stored. It does not change who can see a record in the app. A user with access still sees the decrypted value.
That is the part that surprises people. Encryption helps with a stolen backup or a storage-level exposure and with some contractual requirements. It does not fix a user who has View All Data.
There are trade-offs too. Salesforce notes encryption can restrict how encrypted fields are used in filters and views. Before you encrypt a field, list where it is used: reports, list views, search, duplicate rules, integrations and automation. Test in a sandbox first.
Good fit if a contract, funder or your own risk assessment calls for encryption of specific fields, such as identifiers or sensitive notes, and you accept the usage limits.
Poor fit if you plan to encrypt everything "to be safe." Encrypting broadly makes the org harder to use.
What you can do before buying Shield
Salesforce's shared responsibility guidance says customers manage the security settings on their platform, and that many of these responsibilities can be handled by admins without add-on products (Salesforce, Foundationals, Configurables and Enhanceables, checked November 2026). In practice, check these first:
- Tighten permissions. Remove View All Data, Modify All Data and Export Reports from people who do not need them. See who can see health data in Salesforce.
- Review the sharing model. Set org-wide defaults to the most restrictive level that works. Our post on sharing model best practices explains how.
- Turn on multi-factor authentication and sensible login controls.
- Use standard field history tracking on your most sensitive fields.
- Offboard promptly. Dormant accounts cause more trouble than most missing add-ons.
If these are not done, Shield is solving the wrong problem. If they are done and you still have a documented gap, Shield becomes a reasonable next step.
A simple way to decide
Answer these questions honestly:
- What exactly are we trying to prove or prevent? Name the requirement. "Better security" is not a requirement.
- Who asked for it? A funder, an auditor, a contract and a board member all carry different weight.
- Which component answers it? Most orgs need one or two components, not all.
- Who will own it? Logs, keys and policies need a named person.
- Have we done the free work first? Permissions, sharing, MFA, offboarding.
If you can answer all five, you are ready to talk to Salesforce about a quote. If you cannot, you probably need an access review before a purchase.
Where Troppus fits
Shield is a Salesforce product, and we do not resell it or quote its price. What we do is look at your access and sharing setup so you know whether the problem is a missing tool or a permissions design. Our Apex Security Check analyzes access risk and finds over-permissioning, and Security Framework Design provides templates for roles, profiles and sharing rules with audit-ready documentation. Both are on our products page.
Frequently asked questions
Is Salesforce Shield required for HIPAA?
We have not seen Salesforce state that Shield is required for HIPAA, and we would not claim it is. What your organization needs depends on your risk assessment, your agreements and your counsel. This is not legal advice.
How much does Salesforce Shield cost?
Salesforce says Shield pricing varies depending on your Salesforce edition and user count. Ask your Salesforce account executive for a quote.
Does Shield replace permission sets and sharing rules?
No. Shield adds encryption, auditing and monitoring. Permissions and sharing still decide who can see what.
Can I buy only one Shield component?
That depends on your contract and what Salesforce offers you. Ask your account executive which components can be licensed separately.
Does encryption stop my admins from seeing data?
No. Encryption at rest protects stored data. Users and admins with access to a record still see the value in the app.
Not sure whether you need Shield?
We can review your permissions, sharing and audit needs, and tell you whether a Shield component would close a real gap or whether the fix is cheaper. Book a free Salesforce health check.