Data encryption for activity variables

concept brazil Updated Sep 10, 2026 1 min read c_DataEncryptActivityVariables.md

You can protect sensitive data passed from Orchestration activities by encrypting input and output variables.

The system never stores encrypted variables as clear text. If the MID Server is used to fulfill the activity, the corresponding ECC Queue's input payload is encrypted if an encrypted output variable is defined in the template. Output variables passed to a downstream activity as input variables maintain their encryption throughout processing.

Inputs that require data encryption come from one of these sources:

Workflows: These inputs are provided through the Workflow Editor and must be in the password2 format for two-way encryption.
Service catalog requests: These input values are provided to an activity as encrypted variables from a service catalog item.
GlideRecord: These are variables attached to any ServiceNow table. The source column in the table must be a password2 type variable.
Activity outputs: These are variables passed as outputs from one activity to a downstream activity as inputs, through the data bus.
Empty string: The system allows you to define encrypted input variables but never pass a value into the variable.

Parent Topic:Create custom activities using custom activity designer templates

31 lines · 2.2 KB Wrap lines

---
title: Data encryption for activity variables
description: You can protect sensitive data passed from Orchestration activities by encrypting input and output variables.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/servicenow-platform/orchestration/c\_DataEncryptActivityVariables.html
release: brazil
product: Orchestration
classification: orchestration
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [Create custom activities using custom activity designer templates, Orchestration activity designer, Classic Orchestration, ServiceNow AI Platform Additional Capabilities, Extend ServiceNow AI Platform capabilities]
---

# Data encryption for activity variables

You can protect sensitive data passed from Orchestration activities by encrypting input and output variables.

The system never stores encrypted variables as clear text. If the MID Server is used to fulfill the activity, the corresponding ECC Queue's input payload is encrypted if an [encrypted output variable](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/servicenow-platform/orchestration/t_CreateAnOutputVariable.md) is defined in the template. Output variables passed to a downstream activity as input variables maintain their encryption throughout processing.

Inputs that require data encryption come from one of these sources:

-   Workflows: These inputs are provided through the Workflow Editor and must be in the password2 format for two-way encryption.
-   Service catalog requests: These input values are provided to an activity as encrypted variables from a service catalog item.
-   GlideRecord: These are variables attached to any ServiceNow table. The source column in the table must be a password2 type variable.
-   Activity outputs: These are variables passed as outputs from one activity to a downstream activity as inputs, through the data bus.
-   Empty string: The system allows you to define encrypted input variables but never pass a value into the variable.

**Parent Topic:**[Create custom activities using custom activity designer templates](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/brazil/markdown/servicenow-platform/orchestration/create-custom-activities.md)