Secure your instance

Configure the protection rules for each table and operation to complete the configuration of the log protection plugin.

Access Analyzer debug logs supply detailed information about the evaluation of access controls for a specific operation. These logs assist administrators and developers in troubleshooting access issues, optimizing security configurations, and verifying that users have appropriate access to resources within the ServiceNow platform.

View, reanalyze, or export results from previous searches.

ServiceNow Access Analyzer is an access diagnostic tool for AI administrators or creators to validate the access controls configured within various resources and agentic assets (agentic workflows and AI agents).

Use the Access Management Console within Security Center to review and remediate access issues and misconfigurations. The Access Management Console provides enhanced visibility and control of your Access Analyzer findings, and streamlines remediation efforts. Within the console you can track, prioritize, and resolve access issues by assigning tasks.

Access findings feature displays the potential vulnerabilities that are discovered the last time access checks were ran on your ServiceNow AI Platform.

Access Insights helps you analyze or troubleshoot role and group entitlements through peer-level comparisons.

ServiceNow AI Platform's Access management console to ensure that the right individuals have the appropriate permissions to the right resources at the right time.

Access Management enables you to have access to ServiceNow instance securely.

Use Access Observer to understand people and processes access data on your instance.

As a feature within Access Analyzer, you use access simulator to pre-validate the effects of adding or removing roles and groups for a specific user without actually implementing the changes.

To activate the Continuous Authentication feature on your instance, install the Zero Trust - Continuous Authentication (com.snc.zero_trust_continuous_authentication) plugin.

With subscription to Column Level Encryption Enterprise, an admin can activate the com.glide.now.platform.encryption plugin.

Activate either Field Encryption Starter or Field Encryption Enterprise.

Activate the Zero Trust - Policy Based Session Access com.snc.zero_trust_session_access plugin to enable security admins to reduce or limit user access in a session based on IP address, location, Identity Provider attributes, and user attributes using adaptive authentication policies.

Use the Simulate Add Role for simulating the user's access changes for a resource (table).

Use the Simulate Add to Group for simulating the user's access changes for a resource (table).

Create a cryptographic specification to define the algorithm for a cryptographic module. Customize the encryption specifications with advanced options that are available for Column Level Encryption Enterprise.

Create a cryptographic specification to define the algorithm for a cryptographic module. Customize the encryption specifications with advanced options that are available for Field Encryption Enterprise.

Use Antivirus Scanning to help protect your instance against virus infections that can be introduced by file attachments to your system records, such as incidents, problems, and stories.

Understand how encrypted data in base tables is handled when it moves to archive tables and get guidelines for properly configuring Encrypted Field Configurations (EFCs).

Modify the com.glide.encryption.enable_attachment_key_ui property to prevent your users with access to an encryption module key from attaching unencrypted attachments.

This walkthrough shows you how to encrypt an attachment in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.

Use Audit Management Console module to experience a more enhanced way of defining and configuring the audit capability within your instance.

Configure system log table protection rules to limit the scope of modification and deletion of application log records. The rules enable you to determine the logging of changes or attempts to changes in these tables.

Automatically generate batch update sets for records with invalid or missing signatures on the trusted instance.

Domain separation may work better for your customers' organizations than any other method for separating the data between groups and departments.

You can use a Before Query business rule to help support data segregation on an instance. ServiceNow applications that support domain separation may support the separation of data and data routing only, have advanced business logic separation, or support tenant (customer) level administration of the application.

Use a "contains" query only in special cases, such as when users or groups need to see data from a domain that they don't have access to, but you don't want to move those users to a domain. Creating domain "contains" and user or group access for a domain should be an exception, only when absolutely needed.

Using database queries with domain separation in your customers' applications help them protect their data. These queries then speed up the configuration and build processes.

Debugging SQL and slow queries can help you resolve slowness issues in an instance.

You can use decision trees and a comparison chart to determine if a new customer should be added to a shared instance or to their own dedicated instance.

Organizing your domains is a crucial part of the domain separation process. If you don't set a default domain, new tasks and user records go to the global domain. Anyone can see the records in the global domain, which means that data can be seen when it is not supposed to.

With domain separation (also known as the ServiceNow Multitenant Platform Architecture), you can segregate application data, UI, and business logic in a single customer instance that supports hierarchical modeling with cross-tenant (customer) intelligence.

A multi-tenant architecture is where you have a single instance serving multiple tenants. Data, metadata, business logic, and processing context for tenants is automatically handled with access to additional tenant data.

With domain separation, service providers can have a multitenant instance architecture that delivers offerings efficiently and securely to their clients. Strong universal process standards, data-driven process design, strict governance, and centralized administration help to maximize these benefits.

How you assign a domain impacts the value of the sys_domain field. The assignments contain designs and business properties that affect how the application functions in each domain.

You can avoid slowdowns and performance impacts in your instance by knowing how domain hierarchies work and by setting them up properly.

Choose from three categories for domain separation of an application for your customers' organizations.

Check the domain logs to find errors or warnings in your domain path processes and hierarchy configurations.

Use the domain picker wisely, and remember the 80/15/5 approach so that you do not customize too much and impact the performance of your instance.

You can customize your customers' company properties and themes within the domains that you have configured. Customization makes their instances fit in with their companies' overall look and feel.

You can create effective queries with domain paths.

The context of a user's session determines the processes, data, and user interface (UI) as the user browses through list views, home pages, reports, and knowledge articles. The context is determined by the processes that you create, the business rules that you set, your workflows, and other factors.

Create a hierarchy when defining a domain architecture to track your processes and workflows.

You can create, implement, and maintain domain separation for your applications and services.

You can use a separate instance as an alternative to domain separation for your customers. A separate instance allows you the flexibility to meet the requirements for data separation within the groups and departments in an organization with little to no impact on others.

For the best outcome, be aware of how the properties in the CSM plugin work. When the plugin is enabled, you can see the status of your records in your domains.

You may need to create custom tables in separate domains. This topic covers both the procedure and the concept behind domain-separating a custom table.

You can set up separate domains for email notifications and customize the properties of catalog, tables, users, groups, and views. This enables you to provide more specific behavior in each domain, giving your customers more flexibility.

You may find that domain separation doesn't always work for your customers' organizations. It's best that you base your decision to go with domain separation by looking at your customers' needs.

Domain paths can cause the values of your script to change or even break, so don't use them in scripts.

As you configure domain separation in your application and services, make sure that you consider the number and properties of domains you create. Too many property-heavy domains can impact the performance of your instance.

You can segregate and secure data on the ServiceNow platform in multiple ways, depending on your customer's needs.

The service provider connector application is a reference design for creating a ServiceNow Store application for your customers to use to integrate with your systems. Service provider applications help you speed on-boarding and create standardized integrations.

Service provider (SP) customers can access SP services by using a portal to a dedicated instance. SPs use these dedicated instances to manage their service delivery.

Your customers can access service provider (SP) services by using a portal that is designed for them to reach their domain-separated instance.

Use the hybrid service provider (SP) reference architecture for a customized solution. Your customers require a dedicated instance for a specific service. They can still use the shared SP instance for other services, but it requires integration of each instance.

The Service Integration Management Service Integration and Management (SIAM) for service provider (SP) architecture integrates services for a unified customer experience.

With a ServiceNow instance, you can improve efficiency, add greater security, and increase performance for your customer organizations. It's helpful to understand some of the most common terms as you create your configurations.

With domain separation, you can segregate application data, UI, and business logic, such as rules or workflows, in a single customer instance. Separating these elements into logically defined domains supports specific hierarchies for all customers using your applications.

Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others.

Your instance requires certificates to establish secure connections and validate signatures.

Generate Code Signing signatures automatically when you commit application files to source control from a trusted instance. The signatures are added to the same update set as their source records and are pushed to the remote repository together.

Process administration allows administrators to set domain-specific policies.

The Audit [sys_audit], History Sets [sys_history_set], and History [sys_history_line] tables store the same data, but they serve different purposes and manage data differently.

The instance offers domain selection via two menu formats.

By default, domain separation adds a domain field to tables and their extensions.

Domain scope defines what users can and cannot access.

With domain separation you can separate data, processes, and administrative tasks into logically defined domains.

Administrators can view information about domain separation, identify potential issues, and change configuration settings.

Setting up domain separation involves requesting activation of a plugin, setting options, and assigning users and records to domains.

Visibility domains control what a specific user or group of users can see. "Contains" domains control what an entire domain of users can see.

Elevated privilege roles require you to manually accept the responsibility of using the role before you can access the features of the role.

High Security Settings refer to several security options available in your instance.

The system automatically generates History Set records as needed from the Audit table when a user either creates a record or views its history.

You can view a timeline of changes for a CI and for its related records, relationships, baselines, and proposed changes for the CI. Timelines are available for CIs in the Configuration Item [cmdb_ci] table or a descendant of this table, if auditing is enabled for the tables.

Remove unwanted code and protect against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields.

Use a virtual private network (VPN) to integrate your instance with external data sources over the Internet.

The SNC Access Control plugin (com.snc.snc_access_control) enables you to control which Customer Service and Support employees can access your instance, and when.

The System Diagnostics application provides logs that relate to the platform.

Administrators can track changes to reference field display values.

By default, the system does not create Audit records for inserts because in a typical instance, inserts can account for over 80% of the size of the Audit table.

The ServiceNow AI Platform tracks inserts and updates to audited records in the Sys Audit (sys_audit) and Audit Relationship Change (sys_audit_relation) tables.

Describes the details about Continuous Authentication (CA) logs. The CA logs display all the authentication attempts performed by the users.

Continuous authentication in ServiceNow enables you to reverify and authenticate a user if they access resources that are protected by you.

View the different metrics for continuous authentication.

View the different continuous authentication policies that are created.

Use system properties to enable and customize continuous authentication (CA) to meet your zero trust access security requirements.

Review and approve certificate revocation requests from the email approval notifications that are sent to your registered email address. Review the approval notification and select the Click here to approve or Click here to reject link to access the protected instance and act. You can also access the approval request and the code-signing quorum request directly from the email.

The quorum-controlled certificate revocation for Code Signing certificates provides a secure mechanism for a Code Signing admin to revoke Code Signing certificates. The revocation process involves submitting a request that requires approval from multiple stakeholders. This workflow helps to prevent accidental or unauthorized revocations.

Trust and use your own certificates instead of relying on ServiceNow build certificates (default) by changing to use your Root of Trust (ROT). ServiceNow components like script includes, business rules, etc., are signed at build time using a ServiceNow build time key (verification certificate is the ServiceNow build certificate).

Use the check role access for encrypted column skill to identify user roles that have access to encryption and decryption keys in your instance.

Establish the relationship in a designated trusted instance using Code Signing. This first step loads two cryptographic keys into the trusted environment to establish a trusted source for updates to the production instance.

Run the Classify assets with ServiceNow Vault agent to get a recommended data class for each ServiceNow column in the Data Catalog, review the recommendations, and apply them.

Use the migration status page to track the migration of encryption contexts to encryption modules.

The tour gives a brief overview of the Column Level Encryption setup needed to encrypt table fields or attachments.​ Steps for the creation of Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations are also covered. The tour includes links to detailed documentation and the ServiceNow University Column Level Encryption Overview course.​

Create encryption keys and a certificate using terminal commands on your local environment.

Upload your key and certificate to the ServiceNow Trusted Key Store.

Create a group for your secrets. Secret groups to organize your secrets into groups, and enable you to apply access policies to those secrets at a group level. Then associate your secrets group to an identity group, and add your MID Server to that identity group.

Create a credential to authenticate into a third-party system.

Upload your public/private keypair to your MID Server. This keypair enables the MID Server to handle authentication requests from your instance.

On your instance, use Workflow Studio to manage an integration between your local network and your instance.

Test your integration, and review the execution details to confirm your configuration is working.

Verify that your Windows Management Instrumentation (WMI) credential is encrypted with Secrets Management and use an Integration Hub workflow to complete end-to-end testing.

Learn how to configure your instance to use client accessible secrets.

Learn how to reconfigure secrets groups and client secrets groups after a clone.

Code Signing adds the following properties.

The Key Pair and Certificates dashboard displays details about the cryptographic keys and digital certificates used for Code Signing. It includes information such as key type, certificate issuer, expiration date, and validity status. Use this dashboard to manage code signing certificate credentials, verify their validity, and help ensure secure and trusted Code Signing operations.

The Code Signing Configuration dashboard displays the system properties and key settings that control Code Signing in your environment, including flags and enforcement policies. These settings enable features, enforce signature validation, and define trusted sources.

The Code Signing Health and Status dashboard provides a centralized, user-friendly view of your Code Signing environment's health and configuration. Use it to identify issues, verify configuration accuracy, and support secure, uninterrupted code-signing operations.

Use Code Signing to create digital signatures that prevent unauthorized or tampered External Communication Channel (ECC) queue records from being processed by MID Servers. This cryptographic verification helps maintain the integrity of integrations between ServiceNow and external systems.

Manage and configure the trust relationships and certificate settings for MID Servers.

Reference topics provide additional information to administer and troubleshoot Code Signing.

The Utilities dashboard provides a unified workspace to monitor signature status, detect configuration issues and maintain the overall health of your Code Signing environment. It consolidates common Code Signing administrative tasks into a single interface, eliminating the need to navigate across multiple areas of the instance.

This walkthrough shows you how to encrypt a field in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.

Column Level Encryption permits and denies access to encrypted data based on user role. Column Level Encryption includes basic key management using encryption modules.

Use Access Analyzer to compare two users' access control.

Compare user records to understand the access between two users.

Compound security attributes enable you to create consistent and reusable security attribute profiles to suit your business needs.

Create an access observation record to review access to a data column during a specified time window.

Activate and configure Code Signing to verify the authenticity and integrity of your data.

Learn how to enable and configure a Field Query Role attribute.

Enable and configure the Access Insights feature in Access Analyzer.

Configure the Take actions options to complete the role and group assignments that you need to add after the simulation.

Configure Antivirus Scanning across your instance and at the table level.

Enable the audit deletion estimation feature that calculates the approximate number of records that will be deleted based on retention policies. This information helps you make an informed decision before applying a retention policy, which permanently deletes audit data and cannot be reversed.

Procedure that describes end-to-end configuration of continuous authentication policy for a table and the impacts to the users due to the configuration changes.

Procedure that describes end-to-end configuration of continuous authentication policy for a data class and the impacts to the users due to the configuration changes.

Configure continuous authentication (CA) policies to re-authenticate the users if there's an attempt to access resources that are protected by you.

Configure whether an audit is active and how frequently it runs.

Use cryptographic specifications to define the purpose, algorithm, key length, mode, and origin of your encryption key.

Create an encrypted field configuration to specify which fields are encrypted on a table, and whether that table's attachments are encrypted.

Configure Field Encryption modules by selecting and updating module settings.

Learn how to configure a Field Query Restriction

Use Identity Provider (IDP) attribute created from the Security Assertion Markup Language (SAML) response and OpenID Connect (OIDC) for removing or restricting user session access to the instance.

Review the system properties for the ephemeral public wrapping key that your instance uses to unwrap customer-supplied keys.

Execute a script to run the cryptographic module policy for a cryptographic purpose. Specific read (decrypt/unwrap) or write (encrypt, wrap) access can be defined based on the module access policy operation granularity.

Learn how to create security data filter rules to grant your users' access to records and tables.

Configure Session Access to reduce user access in a session based on IP, location, Identity Provider attributes, and user attributes using adaptive authentication policies.

Specify which tables in domains are large and whether you want detailed logging.

Learn how to activate and configure Column Level Encryption and manage migration from Encryption Support.

Learn how to activate and configure Field Encryption and manage migration from Encryption Support.

Install the ServiceNow Otto for Vault application from the ServiceNow Store to get AI capabilities within Vault.

Learn how to install and configure ServiceNow Vault.

Enable administrators to define and enforce granular control for integration users by introducing User Access Profiles. This feature provides an additional layer of security and control, allowing admins to specify the exact resources (REST APIs and SOAP APIs) that an integration user can access, ensuring tighter governance and minimizing security risks.

After you create a cryptographic module, access the corresponding cryptographic specification to define the algorithm.

After you create a cryptographic module, access the corresponding cryptographic specification to define the algorithm.

Create two key pairs to signed certificates to establish trust between your protected and trusted instances.

Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.

Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.

Create new security attributes with a step-by-step guide.

Create a secret group cryptographic module to perform encryption and decryption.

Create an update set in the trusted environment to export the trusted certificate to the production environment.

Reference table of Code Signing actions, their descriptions, and the roles required to perform them.

Use update sets to sign and validate the flows, subflows, and actions by enabling the Code Signing in protected and trusted instances.

Use update sets to sign and validate the JDBC data sources by enabling the code signing in protected and trusted instances.

Access various logs to troubleshoot and identify the failure reasons.

Sign and validate the new REST and SOAP messages from the trusted instance by enabling the Code Signing in protected and trusted instances.

Use update sets to sign and validate the REST and SOAP messages by enabling the code signing in protected and trusted instances.

Code Signing includes the following roles.

Review the create, update, and delete operations that users perform on records protected by Code Signing.

Assign the Code Signing Administrator role to a user to access the Code Signing configuration experience.

Turn on and configure Code Signing on your protected instance.

Disable code signing on your protected instance.

Protect your instance with certificate based validation.

Turn on and configure Code Signing on your trusted instance.

Upload the configuration file generated on your trusted instance.

You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.

You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.

Configure the External Communication Channel (ECC) firewall in your MID Server by specifying the custom rules to selectively allow or reject the incoming message and override the Code Signing configuration.

If the Field Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.

Use Data Privacy to classify sensitive data and to remove personally identifiable information (PII) from user data in a production instance and anonymize data in non-production instances. Once anonymized, the user data is no longer considered regulated private information.

Generally data filters are applied after absolute ACLs (also sometimes called table-level ACLs), and after row-level ACLs. They are applied by default, and can be impactful to system behavior if not used carefully.

Clean up inactive leaf level domains in the domain hierarchy with a controlled and automated tool.

Enable viewing original unformatted log messages by disabling the collapsible stack trace formatting in system logs.

Dictionary attributes alter the behavior of the table or element that the dictionary record describes. As an administrator, you can set the values of dictionary attributes to modify the behavior of the default Antivirus Scanning configuration.

Run a scheduled job on your trusted instance to disable Root of Trust.

Use the glide.db.loguser property to disable SQL error messages from rendering in a browser.

Queue multiple Domain Separation updates sequentially into a single background job using the Domain Job Manager.

With the ServiceNow Platform, service providers (SPs) can provide their customers with faster onboarding, meet compliance, and protect their data using domain separation. You can separate client data, processes, and reports into logical groupings called domains. SPs control who sees and accesses what content.

With the Domain Override Viewer, you can see and manage all your process overrides at once across the entire instance.

The Domain Support - Domain Extensions Installer plugin activates several domain separation features and properties at once. This plugin is typically referred to as the Domain Separation plugin.

Many ServiceNow applications support domain separation in the base system but not all. Some supported applications include limitations on the data and administrative settings that can be domain-separated. These definitions delineate the domain separation support levels from the perspective of actual use cases and the people who use them.

You can see at a glance which tables are domain-separated in your instance with the Domain Separated Tables feature.

Audit your domains regularly to reveal problems.

Additional assistance with Domain Separation

The Domain Separation plugin has two new tables to give service providers more flexibility in customizing their applications that use domain separation. These tables are the System Application Property table [sys_application_property] and the System Application Property Value table [sys_application_property_value].

Domain separation is designed to give ServiceNow service providers (SPs) the ability to configure the services they offer to their customers. It is not designed to enable their customers to administer those services themselves, except in a few areas that this topic details.

Install the External Key Management Service (EKMS) plugin and configure user permissions to enable external key management functionality.

Modify the status of your Amazon Web Services Key Management System (AWS KMS) key and synchronize the status with your ServiceNow instance.

View the status of your Amazon Web Services Key Management System (AWS KMS) key in your instance.

Configure your external encryption key to use in External Key Management Service (EKMS).

Set up External Key Management Service (EKMS) to control the encryption of your ServiceNow data using your Amazon Web Service Key Management System (AWS KMS).

Create a cryptographic module that uses external Amazon Web Services Key Management System (AWS KMS) key wrapping to encrypt ServiceNow data.

Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.

External Key Management Service (EKMS) enables you to integrate Field Encryption with your own external key management systems.

Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.

Test your external encryption key to use in External Key Management Service (EKMS).

Manage and maintain your External Key Management Service (EKMS) configuration after initial setup

Turn on Code Signing in your trusted non-production instance to identify the trusted instances linking to your production instance.

Track users who perform actions through impersonation in audit logs.

Enable a table to audit only those fields you explicitly designate. This is useful when you want to audit only a small number of fields in an audited table.

Encrypt data with more than one encryption module permitting the user to determine which keys are used for specific rows within the encrypted data.

Encrypt fields with multiple Field Encryption modules using Row Conditions to define the data being encrypted and the associated encryption keys. Row Conditions can also be used to define the users that have access using the condition builder.

Protect your sensitive data and stay compliant with regulatory  requirements and standards.

Use the Key Management Framework (KMF) to generate, exchange, store, use, and replace the cryptographic keys used to encrypt and decrypt sensitive data on your ServiceNow instance.

Explore the Attribution field in the node log lines to identify the script or component that generated the log message. Transaction start lines include the new field to identify the type of request made.

Audits typically run as scheduled. You can, however, run all audits on command.

You can give both internal users and external users access to your instance. However, you might not want both types of users to have the same level of access. To provide added security, every user must have at least one role so that the instance can distinguish between internal and external users.

Analyze identities on the ServiceNow AI Platform instance.

Access findings feature displays the potential vulnerabilities that are discovered the last time access checks were ran on your ServiceNow AI Platform.

Access Insights is a feature within the Access Analyzer application that provides data-driven recommendations and comparative analysis regarding user, role, and group entitlements.

Access Simulator helps you pre-validate how access to a specified table would change after a role or group is assigned or removed from the user.

Code Signing provides cryptographic verification to ensure that only authorized scripts can execute on MID Servers. Code Signing prevents unauthorized or tampered External Communication Channel (ECC) queue records from being processed by MID Servers, maintaining the integrity of integrations between ServiceNow and external systems.

ServiceNow's continuous authentication (CA) enables you to re-verify and authenticate a user if they access resources that are protected by you.

The Scripting Governance Tool provides a single, centralised control for managing scripting access across your ServiceNow AI Platform.

Zero Trust Access (ZTA) is a security model that assumes that no user or device is trusted by default.

The SNC Access Control plugin (com.snc.snc_access_control) enables you to control which Customer Service and Support employees can access your instance, and when.

Use Antivirus Scanning to help protect your instance against virus infections that can be introduced by file attachments to your system records, such as incidents, problems, and stories.

Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others.

Your instance requires certificates to establish secure connections and validate signatures.

Learn more about Column Level Encryption.

Learn the details of Field Encryption Starter and Field Encryption Enterprise

High Security Settings refer to several security options available in your instance.

Remove unwanted code and protect against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields.

With the ServiceNow Otto for Vault application, you can automate many tasks in Vault with the help of AI. These tasks include securing custom applications to improve your security posture, checking role access for an encrypted column to instance’s encryption access posture, and others.

Use ServiceNow Secrets Management for granular management of access to your passwords to fit your business needs.

Learn more about ServiceNow Vault and review the benefits it can provide for your data protection needs.

Use a virtual private network (VPN) to integrate your instance with external data sources over the Internet.

Start the certificate revocation process by selecting the certificate that you want to revoke. Provide the required configuration properties. Export this transaction as part of an update set, which is imported into the protected instance for approval and execution.

Export the results from an Access Analyzer query.

Frequently asked questions about using Access Simulator.

Bring your own data encryption key to the platform instead of using the one that ServiceNow generates.

Create a module access policy (MAP) for a matched user to encrypt attachments when inbound email processing runs as that user.