Having each system pull the record changes from Salesforce using change data capture (option D) is the correct solution for ensuring all systems using customer data are kept up to date, as it allows the systems to subscribe to real-time events from Salesforce and receive notifications when customer records are created, updated, deleted, or undeleted. Sending customer data nightly to the system of truth in a scheduled batch job (option A) or sending customer record changes from Salesforce to each system in a nightly batch job (option B) are not good solutions, as they may cause data latency and inconsistency, and they do not provide real-time updates. Sending customer record changes from Salesforce to the system of truth in real time (option C) is also not a good solution, as it does not address how the other systems will receive the updates from the system of truth.

The best solution to make sure decrypted values are exported during data export is to create another field to copy data from encrypted field and use this field in export. This is because classic encryption does not support exporting decrypted values of encrypted fields. The view encrypted data permission only allows users to view decrypted values in the user interface, but not in reports or data exports. Therefore, a workaround is to create a formula field or a workflow field update that copies the value of the encrypted field to another field, and use that field for data export. However, this solution has some drawbacks, such as exposing sensitive data in plain text and consuming extra storage space. A better solution would be to use Shield Platform Encryption, which supports exporting decrypted values of encrypted fields with the Export Encrypted Data permission