All files uploaded to Drive or created in Docs, Sheets, and Slides are encrypted in transit and at rest with AES256 bit encryption. For additional confidentiality, your organization can allow you to encrypt Drive, Docs, Sheets, and Slides files with Workspace Client-side encryption. Encrypted files have some limitations from standard files. You can also upload any Drive file types like PDFs and Office as encrypted Drive files.
Important: To encrypt Drive, Docs, Sheets, and Slides files with Workspace Client-side encryption:
- You must have a Workspace account.
- Your administrator must enable client-side encryption.
- You must verify your identity.
Learn about encryption
Encryption is the process of encoding information to protect your data. Only users who have Workspace Client-side encryption enabled by their admin and have verified their identity can make or copy encrypted files. On an encrypted file, any user with whom the file has been shared can access it using an encryption key unique to that file. Normally Google encrypts your content in transit and at rest, but with client-side encryption your domain has chosen to add an extra layer of protection.
Things to know about encryption- Your domain administrator has control over which groups and individuals can use encryption. If you would like to move files to locations with encryption turned off or to turn on this feature for new locations, contact your administrator.
- Client-side Encryption provides an extra layer of protection for your organization. Your files are encrypted from end-to-end and between clients. Google cannot decrypt your files. Keep in mind:
- Applications on your computer with sufficient permissions granted, such as Chrome extensions, may be able to view and exfiltrate encrypted files.
- Encryption does not protect your files from someone who can view your screen.
- How often you’re required to resign in to open client-side encrypted files, is up to your admin. If you have to sign in often, contact your admin.
- A lock
appears next to an encrypted file.
- Only one person can edit an encrypted file at a time. Learn how to collaborate on encrypted files.
- In encrypted files, autosave starts every 30 seconds, unless your device is idle or you perform another action, like share a file or attempt to exit a file.
- If you attempt to exit an unsaved file, you get a warning. To avoid the loss of your unsaved changes, click Cancel.
- Autosave has 3 statuses:
- Waiting to save: Waits for an autosave trigger or the 30-second timer.
- Saving: A save is in progress. You can continue to edit your file.
- Saved to Drive: You haven’t made any changes. Your version is current.
- There are different steps to create encrypted files. Learn how to make or copy encrypted files.
- In order to access encrypted files, your admin may require you to sign into an additional SSO service twice, once for your organization's IDP and once with Google for Drive, Docs, Sheets, and Slides.
- You can print from Docs or Sheets, but not from Slides.
- Spellcheck for encrypted Docs and Slides is available in American English, British English, French, German, Italian, and Spanish.
- Spellcheck isn't available in Sheets.
- You can export a Sheets file into an Excel file. Go to File
Download.
- Version History for encrypted files retains up to 100 versions. After you exceed 100 versions, less significant versions are removed automatically. Named versions aren't yet available.
- Encrypted Docs, Sheets, and Slides have a maximum size of 100 MB. Encrypted Drive files have no limit.
- The maximum number of images in a document is 3,000.
- A single image size is 1 MB.
- Downloading a folder doesn't affect client-side encrypted files.
Download.With encrypted files, you can’t:
- Open Office editing mode
- Comment
- Use the mobile app to edit Docs, Sheets, or Slides
- Use functions in Sheets that make external calls
- Import Microsoft Office files into Docs, Sheets, or Slides
- Use certain tools, which includes:
- Grammar check
- Translate and compare documents
- Voice typing
- Add-ons
- Download or use file preview for Docs, Sheets, or Slides
- Open encrypted files offline
Make or copy encrypted files
Important: To make or copy encrypted files, you need to:
- Sign into a work or school account
- Have client-side encryption enabled by your admin
- Verify that your account can create files
To create an encrypted document, spreadsheet, or presentation, choose an option:
From Google Drive:
- Go to drive.google.com.
- At the top left, click New
.
- Point to the arrow next to Docs, Sheets, or Slides
- In the “New encrypted document” window, click Create.
.From Google Docs, Sheets, or Slides:
- Open a Google Docs, Sheet, or Slide.
- At the top, click File.
- Point to New;
- In the “New encrypted document” window, click Create.
Tips:
- If you create an encrypted file in a Shared folder, the encrypted file has the same access as the folder.
- If the options for Blank encrypted document/spreadsheet/presentation or New encrypted document/spreadsheet/presentation aren't available:
- Confirm you’re logged into your work or school account.
- Check if your admin permits client-side encryption.
- Ensure you verify your identity. Learn more about encryption with your identity provider.
- Go to drive.google.com.
- At the top left, click New
- Point to the arrow next to File upload
Tips:
- If you upload an encrypted file in a Shared folder, the encrypted file has the same access as the folder.
- If the option for Encrypt and upload file isn't available:
- Confirm you’re logged into your Workspace account.
- Check if your admin permits client-side encryption.
- Ensure you verify your identity. Learn more about encryption with your identity provider.
Important: You can only copy encrypted Drive files.
- Right or double click the file, then select Make a copy.
- If the file doesn’t already have encryption, you can also Make an encrypted copy, just as you can Make a decrypted copy if the file does.
Tip: If the options for Make an encrypted copy or Make a decrypted copy aren’t available:
- Confirm you’re logged into your work or school account.
- Check if your admin permits client-side encryption.
- Ensure you verify your identity. Learn more about encryption with your identity provider.
- Open a Google Doc, Sheet or Slide.
- At the top, click File
Tips:
- Features not supported by client-side encryption are made static or removed.
- Features made static:
- Checklists
- Embedded drawings, charts, and tables
- Linked forms
- External data functions like GOOGLEFINANCE
- Connected Sheets
- WortArt
- Features removed from the document:
- E-signature fields
- Comments and suggestions
- Protected ranges
- Features made static:
- If Add encryption doesn't display:
- Confirm you're logged into your work or school account.
- Check if your admin allows client-side encryption.
- Confirm that you are the owner of the document in My Drive or the Manager of the shared drive.
- Verify your identity. Learn how to connect with your identity provider.
Remove encryption from a document
- Open a Google Doc, Sheet or Slide.
- At the top, click File
Tips:
- If Remove additional encryption doesn't display:
- Confirm you're logged into your work or school account.
- Check if your admin allows client-side encryption.
- Confirm that you are the owner of the document in My Drive or the Manager of the shared drive.
- Verify your identity. Learn how to connect with your identity provider.