Salesforce Shield Pricing and When You Don’t Need It

Salesforce Shield bundles three capabilities — Field Audit Trail, Event Monitoring, and Platform Encryption — as a premium add-on priced on top of your org’s existing licensing. It’s a real answer for orgs with specific compliance or security requirements. It’s also frequently sold into orgs that need one of the three capabilities and end up paying for the bundle.

What Shield actually includes

• Field Audit Trail — extends field history tracking retention and depth beyond Salesforce’s standard limits.
• Event Monitoring — detailed logs of user activity (logins, API calls, report exports) for security and usage analysis.
• Platform Encryption — encrypts specific fields and files at rest, beyond Salesforce’s standard encryption.

All three are sold as one bundle, priced as a percentage add-on across the org’s licensed users — not selectable individually in the standard offering.

Questions worth answering before buying Shield

Do you actually need all three capabilities, or just one?

A common pattern is a compliance requirement that only touches encryption, or an audit need that only touches Field Audit Trail — but Shield is priced and sold as a bundle. Confirm with your Salesforce account team whether any of the three are available piecemeal for your edition before assuming the full bundle is the only path.

Is standard field history tracking already enough?

Salesforce’s standard (non-Shield) field history tracking covers a limited number of fields with shorter retention. For many compliance needs, that’s genuinely sufficient — Shield’s extended retention and field count matter most for regulated industries with specific audit-trail requirements.

Could the actual requirement be met outside the CRM?

If the driver is a specific regulatory audit requirement rather than a general security posture goal, a purpose-built compliance or audit-logging tool — scoped exactly to that requirement — can sometimes satisfy it without paying for org-wide Shield pricing.

Shield vs. scoped alternatives

	Salesforce Shield	Standard Salesforce tools	Custom-built compliance layer
Cost	Bundle add-on, priced across all users	Included in edition	Flat monthly fee, scoped to the actual requirement
Scope	All three capabilities, org-wide	Basic field history, no encryption/monitoring add-on	Built to the specific compliance need
Fit	Regulated orgs needing all three	Orgs with light compliance needs	Orgs needing one capability without the full bundle

Where the actual need is narrower than the bundle, a custom-built layer scoped to the specific audit or encryption requirement avoids paying for org-wide capabilities that go unused. See the broader licensing-cost picture in how to reduce CRM licensing costs, and the related question of what you’re actually licensing in a Salesforce license audit checklist for RevOps.

Frequently asked questions

Is Shield required for HIPAA or SOC 2 compliance?

Not automatically — compliance requirements vary by framework and by what data lives in Salesforce. Confirm the specific control your auditor or compliance team is asking for before assuming Shield is the only path to it.

Can we buy just Platform Encryption without Event Monitoring?

That depends on your Salesforce edition and current offering — ask your account team directly, since piecemeal availability has varied over time and isn’t guaranteed in every package.

What’s the risk of skipping Shield entirely?

For orgs with no specific regulatory driver, the risk is usually low — standard Salesforce security and audit features cover general needs. The risk rises specifically for regulated industries with an actual audit requirement Shield is built to satisfy.