Notification

Duet AI is now Gemini for Google Workspace. Learn more

Protect your organization's data with client-side encryption

Supported editions for this feature: Enterprise Plus; Education Standard and Education Plus.  Compare your edition

Google Workspace already uses the latest cryptographic standards to encrypt all data at rest and in transit between its facilities for all services. In addition, Gmail uses TLS (Transport Layer Security) for communication with other email service providers. Google Workspace Client-side encryption (CSE), however, gives you another layer of encryption that only your organization controls.

How CSE protects your data

With CSE:

  • Your organization uses its own encryption keys, which encrypt data the client's browser before any data is transmitted or stored in Google's cloud-based storage. You can manage your keys using a third-party key management service or by building your own service using the Google Workspace CSE API.
  • Your organization also controls the identity provider used to access your encryption keys.
  • Google servers and third parties can't access your encryption keys and decrypt your data, which can help your organization meet additional security or compliance requirements.
  • You can create policies to allow specific users to create client-side encrypted content and share or send it internally or externally.
  • Users can encrypt data with CSE simply by choosing an option in the app—there's no need for them to set up encryption, use extensions, or manage any encryption keys.

Which organizations can benefit from CSE

CSE is especially beneficial for organizations that have any of the following needs:

  • Confidentiality for organizations working with sensitive intellectual property
  • Compliance support for organizations in highly-regulated industries that have ITAR, CJIS, TISAX, IRS 1075, or EAR requirements
  • Data sovereignty for organizations needing demonstrative data control using encryption keys that can be held at a specific site, within a nation’s borders, or any other defined boundary
  • Export control for public sector organizations that need to ensure data is encrypted and the keys are inaccessible outside their country’s borders

For example, CSE is especially useful for these industries:

  • Large organizations that need to comply with European regulations
  • Aerospace and defense contractors
  • Criminal justice and law enforcement agencies
  • Federal, state, and local agencies and organizations that work with them

Supported services, applications, and data types

Service Apps Data that's client-side encrypted Data that's not client-side encrypted
Google Drive and Google Docs Editors
  • Web browser
  • Drive for Desktop (non-Google file formats only)
  • Android mobile  app
  • iOS mobile app

Note: For mobile apps, client-side encrypted content is view-only and available for non-Google file formats only.

  • Files created with Google Docs Editors (documents, spreadsheets, presentations)
  • Uploaded files, like PDFs and Microsoft Office files
  • File title
  • File metadata, such as owner, creator, and last-modified time
  • Drive labels (also called Drive metadata)
  • Linked content that’s outside of Docs or Drive (for example, a YouTube video linked from a Google document)
  • User preferences, such as Docs header styles

Gmail

  • Web browser
  • Android mobile  app
  • iOS mobile app
  • Email body, including inline images
  • Attached files

    Note: Attaching client-side encrypted Drive files isn't yet supported

Email header, including Subject:, timestamps, and recipients lists

Google Calendar
  • Web browser
  • Android mobile  app
  • iOS mobile app
  • Event description
  • Attached Drive files (if CSE for Drive is turned on)
  • Meet audio and video streams (if CSE for Meet is turned on)

Any content other than the event description, attachments, and Meet data, such as:

  • Event title
  • Event starting and ending times
  • Attendees list
  • Booked rooms
  • Join by phone numbers
  • Link for Meet
Google Meet
  • Web browser
  • Drive for Desktop
  • Android mobile  app
  • iOS mobile app

Note:  Meeting room hardware will be available in a later release.

  • Audio streams
  • Video streams (including screen sharing)
  • Chat messages
Any data other than audio and video streams and chat messages

Was this helpful?

How can we improve it?
Search
Clear search
Close search
Google apps
Main menu
7246979162703649265