---
sourceDocument: Australia Build or modify applications
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/application-development

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Secure data

# Secure data {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Secure data

Data security is a critical aspect when building applications on the ServiceNow AI Platform.
ServiceNow simplifies this by automatically configuring access controls for new or selected roles during table creation, ensuring that only authorized users can read, create, write, or delete table data.
Properly configuring access controls at both table and column levels is essential to protect sensitive information and optimize performance.
Show full answer Show less  

## Key Features

* **Access Control Lists (ACLs):** Combine multiple access controls to precisely manage user permissions on tables, UI pages, property pages, and other content.
* **Role-Based Access:** Only users with assigned roles can access specific tables, minimizing unnecessary exposure.
* **Before-query Business Rules:** Used to secure data by filtering read access before database queries, especially to hide records without alerting users. However, these should be used sparingly and do not replace ACLs.
* **Performance Considerations:** Minimize GlideRecord queries in access control scripts to avoid performance degradation.
* **Subscription Model Impact:** Starting with the Orlando Platform Subscription model, users are charged based on how many tables they can access, regardless of actual use. Proper ACL configuration can restrict access and reduce subscription costs.
* **Encryption:** The platform provides encryption solutions at application, database, and hardware tiers to protect data confidentiality.

## Practical Guidance for ServiceNow Customers

* Configure ACLs early in the application development process to avoid rework and ensure security is integral to interfaces and business logic.
* Secure auto-populated fields by setting them as read-only to prevent unauthorized changes.
* Use ACLs primarily for access control to reduce subscription costs and enforce security, reserving before-query Business Rules for specific read access scenarios.
* Review existing Business Rules, such as the user query Business Rule on the User \[sysuser\] table, to understand best practices for access restrictions.

## Expected Outcomes

By following these guidelines, ServiceNow customers can effectively protect their data, comply with subscription licensing requirements, optimize application performance, and maintain a secure environment tailored to their users' access needs.  
Data security is one of the most important and overlooked aspects of creating an application. ServiceNow automatically configures access control for a new or selected role during the table creation process. Only users with the
role can access the table to read, create, write, and delete.

Use access control rules to configure table and column-level security in the ServiceNow AI Platform. To properly configure access to an application, developers should understand how access controls work and the order in which access controls are
evaluated. Apply multiple access controls that together make an Access Control List (ACL).

Self-Paced Training: [Securing Applications](https://developer.servicenow.com/dev.do#!/learn/courses/rome/app_store_learnv2_securingapps_rome_securing_applications)

Documentation: [Access Control Lists (ACLs)](https://www.servicenow.com/docs/access?context=access-control-rules&version=australia&pubname=australia-platform-security&ft:locale=en-US)  
When considering security:

* Protect tables, UI pages, property pages, and other content with the appropriate access controls and roles.
* Limit the use of GlideRecord queries in access control scripts. GlideRecord queries can affect performance.
{#secure-data__ul_nkz_53m_sxb}  
Beginning with the Orlando Platform Subscription model, customers are charged by how many tables a user can access, regardless of whether the user does access the table. Configure ACLs to restrict access to a table to ensure that only the users that need access to a table can access the table.  
Note:  
Consider making any auto-populated fields read only. If the system is populating the data, a user should not be able to.

Alternately, secure data on the ServiceNow AI Platform with before-query Business Rules. Before-query Business Rules run before the database query and are limited to controlling read access to a record. Only use before-query Business Rules when
necessary. Some considerations when deciding to use Access Controls or before-query Business Rules:

* GlideRecord queries will bypass read access controls on a table and will be restricted by before-query Business Rules on a table.
* When access controls restrict read access to records in a list, ServiceNow shows a message saying that access has been restricted for the records. With before-query Business Rules, the number of records in the list total matches the number of records shown to the user. The user receives no indication that some records have been hidden from the list.

{#secure-data__ul_lpr_x3m_sxb}  
Review the user query Business Rule on the User \[sys_user\] table for reference.  
Note:  
Before-query Business Rules do not take the place of ACLs. Denying users access to a table via before-query Business Rule will still count the table against the subscription model. Use Access Controls to prevent the table from being counted for the users in the Platform Subscription model.

## Encryption {#secure-data__section_dvj_bjm_sxb}

The ServiceNow AI Platform also provides various encryption solutions at the application tier, database tier, and hardware tier. Learn more in the [Data Encryption Whitepaper](https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/white-paper/wp-data-encryption-with-servicenow.pdf).  
Note:  
Set up security before configuring any interfaces or business logic. Since security affects the data available to interfaces and business logic, waiting until the end of the application build process may cause rework and issues.