Built-in Security
Learning Content
Last updated: July 21, 2026
Built-in Security in Apex
Security is one of the core strengths of the Salesforce Platform. Apex provides several built-in security mechanisms that help developers protect sensitive business data and ensure that users can access only the information they are authorized to view or modify.
Unlike traditional programming languages where developers often build security from scratch, Salesforce includes a powerful security model that works together with Apex to enforce data access rules across the platform.
💡 LearnFrenzy Insight
Imagine a corporate office building.
Although everyone works in the same building, not every employee can enter every room.
For example:
- An HR employee can access employee records.
- A Finance employee can access financial reports.
- A Sales representative can access customer information.
Why Do We Need Security?
Business applications often store confidential information such as customer details, financial records, contracts, employee information, and sales data. Without proper security, unauthorized users could view, modify, or delete sensitive records.
Salesforce provides multiple layers of security to protect both data and business processes.
| Security Feature | Purpose |
|---|---|
| Object-Level Security (CRUD) | Controls whether users can create, read, update, or delete records of an object. |
| Field-Level Security (FLS) | Controls access to individual fields within a record. |
| Record-Level Security | Controls which records a user can access. |
| Sharing Rules | Share records with specific users or groups. |
| User Mode & System Mode | Determine how Apex enforces security during execution. |
Simple Security Example
The following example checks whether the current user has permission to create Account records.
// Check Create Permission
if(Schema.sObjectType.Account.isCreateable()){
System.debug('User can create Accounts');
}
else{
System.debug('Access Denied');
}
Debug Log Output
USER_DEBUG [4]|DEBUG|User can create Accounts
This example demonstrates how Apex can verify user permissions before performing an operation.
Real Business Scenario
🏢 Business Example
Suppose a company has three departments:
- Sales Team
- Finance Team
- Human Resources
Layers of Salesforce Security
| Security Layer | Example |
|---|---|
| Organization-Level Security | Login Hours, IP Restrictions |
| Object-Level Security | Account Object Permissions |
| Field-Level Security | Salary Field Visibility |
| Record-Level Security | Private Opportunities |
| Apex Sharing | Programmatically Share Records |
Common Security Features in Apex
| Feature | Description |
|---|---|
| CRUD | Checks object permissions. |
| FLS | Checks field permissions. |
| Sharing | Controls record visibility. |
| with sharing | Respects sharing rules. |
| without sharing | Runs without record-sharing enforcement. |
| inherited sharing | Uses the sharing behavior of the caller. |
✅ Best Practice
Always consider security while writing Apex code. Verify permissions where appropriate, choose the correct sharing model, and avoid exposing sensitive data to unauthorized users.
⚠️ Common Mistake
Many beginners assume Apex automatically enforces every security rule. Depending on how the code is written, developers may need to explicitly check object and field permissions to ensure secure access.
🎯 Interview Tip
Question: What are the main layers of security in Salesforce?
Answer: Salesforce security includes organization-level security, object-level security (CRUD), field-level security (FLS), record-level security, sharing rules, and Apex sharing. Together, these layers help protect business data and control user access.
📚 Learn More
This section introduces Salesforce's built-in security model.
In the dedicated Security in Apex chapter, you'll learn:
- CRUD and FLS Enforcement
- with sharing vs without sharing vs inherited sharing
- User Mode vs System Mode
- Security.stripInaccessible()
- WITH SECURITY_ENFORCED
- Secure Apex Coding Best Practices
- Real-World Security Scenarios
- 40+ Practical Examples
Practice What You've Learned
Test your understanding with these practice exercises