Big Objects are Salesforce storage structures designed for very large data volumes over long retention periods. In this context, they are used to store and query event data at scale, supporting historical analysis while preserving performance for operational systems.
What Big Objects Are Used For
Big Objects are designed to hold extremely large, durable datasets when the main requirement is long-term retention rather than fast transactional processing. They are well suited to event histories, audit-like records, telemetry, and other append-only data where organisations need to preserve detail at scale without letting operational workloads slow down.
The practical value of Big Objects is that they separate historical storage from day-to-day system activity. That matters when the underlying platform must keep growing data volumes available for reporting or investigation, but the core business processes should remain responsive.
How Big Objects Differ From Operational Storage
Big Objects are not a general-purpose replacement for ordinary application tables. They are built around large-scale retention and efficient retrieval patterns, which means the data model usually reflects what you need to search and aggregate later, not what you would design for frequent updates or rich relational processing.
This distinction is important because a storage choice changes how data is written, indexed, queried, and governed. When the workload is mostly historical analysis, the architecture can tolerate stricter constraints in exchange for scale and longevity.
Querying and Retention Patterns
Big Objects are most useful when organisations know the fields they will use to locate records over time. Queries are typically more selective and purposeful than in operational systems, because the platform is optimised for retrieving large retained datasets rather than supporting ad hoc transactional browsing.
That makes schema design and retention strategy part of the term’s meaning. The object is not just a place to store old data, it is a way to keep that data queryable in a controlled, scalable form for later review, analytics, or compliance needs.
Security and Governance Implications
Because Big Objects can preserve sensitive historical data for long periods, they inherit many of the same governance concerns as other durable data stores, including access discipline, retention limits, and data minimisation. The longer data survives, the more important it becomes to define who can query it, why it must be retained, and when it should be removed.
They also create a visibility problem if teams assume old data is harmless. Historical event data can still reveal behaviour patterns, operational detail, and other information that should remain controlled even after it has left the live application path.
Risk and Threat Considerations
Big Objects concentrate long-lived data in a form that is often easier to overlook than active records, which can create exposure if access controls, retention rules, or data classification are too loose. The risk is not the storage model itself, but the tendency for retained event data to outlive its original business purpose and remain broadly searchable.
Failure mechanism: Excessive retention or overly broad query access can expose historical operational data, making it easier for insiders or attackers with account access to reconstruct activity, relationships, or system behaviour over time.
Impact: The result can be confidentiality loss, compliance issues, or a widened blast radius if compromised accounts can mine years of retained data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Big Objects need tightly scoped query access to retained historical data. |
| AU-11 — Audit Record Retention | The term centers on retaining large volumes of historical event data for later use. | |
| SC-28 — Protection of Information at Rest | Big Objects store durable data that remains sensitive while stored long term. | |
| Recommendation — Restrict Big Object read access to the smallest set of approved roles. Set and enforce retention rules for retained event and audit data. Apply storage protections to historical data at rest. | ||
| CIS Controls v8 | 5 — Account Management | Access to retained records depends on tightly governed account and role access. |
| Recommendation — Limit who can query retained datasets through controlled account access. | ||
| ISO/IEC 27001:2022 | A.8.10 — Information deletion | Big Objects raise long-retention questions that require defined deletion and retention handling. |
| Recommendation — Define when retained historical data must be deleted or archived. | ||
Practitioner Guidance
Why practitioners should care: Big Objects should be treated as governed historical data stores, not passive archives. Teams need to decide which datasets belong there, how long they should remain queryable, and which roles should be able to retrieve them.
Common misunderstanding: Long retention does not mean low sensitivity. Event histories, audit trails, and similar records can become more valuable to attackers precisely because they capture context that is unavailable in current-state data.
Practitioner takeaway: Design Big Object usage around explicit retention, access, and review rules so the scale benefits do not turn into uncontrolled data persistence.
Related resources from NHI Mgmt Group
- How should security teams prevent valid credentials from accessing the wrong API objects?
- What breaks when Entra ID recovery only restores deleted objects?
- How should teams handle stale Active Directory objects before access reviews?
- Why do nested objects create authorization risk in search systems?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org