Learn about Meet Client-side Encryption (CSE)

To protect your information, Meet always encrypts call media in transit and at rest. Call media can only be decrypted by the meeting participants and Google's data center services for Meet.

Client-side encryption adds an additional encryption layer for privacy and only shares that session key with:

• meeting participants
• the key service of the meeting host organization (as CSE is used with an IdP/key service infrastructure)

With CSE, all media is encrypted by each participant's browser using keys only made available to the participants. Only the meeting participants can decrypt the call media while it remains unreadable to Google's servers or any other service provider.

To use CSE, your admin must connect Google Workspace to an external identity provider and encryption key service (IdP+key service). Learn how admins manage CSE for your organization.

Learn about CSE requirements in a video meeting

Important:

• On your mobile device, you can’t create CSE meetings in the Google Meet app .
  • You can only create CSE meetings on mobile in the Google Calendar app . Learn how to enable CSE on Google Calendar.
• Due to authentication requirements, users must be invited to join a meeting. Learn how to send CSE meeting invitations.
  • The knocking capability to allow an uninvited guest is disabled.
• CSE is not available on Google Meet hardware.

CSE is available in these Google Workspace editions:

• Enterprise Plus
• Education Standard
• Education Plus

Your Google Workspace administrator who manages Google Meet for your organization must first set up CSE for your organization.

Learn how CSE works in meetings

You can join a CSE meeting the same way you join a non-CSE meeting. For CSE meetings, participants can’t join until the host or a co-host assigned by the organizer has joined. Participants that join before the host get a black screen with the words “waiting for the host to join”.

Learn about unavailable functions in CSE meetings

Due to the extra layer of privacy, these functions are not available in CSE meetings:

• Abuse reporting
• Noise cancellation
• Recordings
• Live streams
• Use a phone for audio
• Add people by phone
• Captions
• Polls
• Q&A
• Jamboard
• Share joining info
• Interoperability through a 3rd party gateway

Learn how to invite a participant to a CSE meeting

If your admin configures CSE for external access, you can invite external participants regardless of whether they use Google Workspace or not. Your CSE call's level of privacy with external participants remains as high as it would be with only internal participants, and session keys are never shared with Google. Learn how admins manage CSE for external access.

Due to authentication requirements, participants must be invited to join a meeting. Participants can no longer knock to join a meeting.

A participant can enter a CSE meeting if the host sends an invitation:

• Through a calendar event. Learn how to invite people to your Calendar event.
• During a video meeting. Learn how to send an invitation through an email.
  • Only invited participants can access the meeting through the meeting code or link.

Create an encrypted event in Google Calendar

Important: You can only add CSE when you create an event.

1. On your computer, go to Google Calendar.
2. At the top left, click Create.
3. At the top right of the event window, click Turn on encryption .
   • You may get a pop-up to authenticate with your IdP. Make sure pop-ups are allowed in your browser.
   • Tip: Always turn on CSE before you enter event details. When you turn on CSE, your event descriptions, unencrypted attachments, and Meet conference settings are reset.
4. Add event details like titles, guests, descriptions, and attachments.
   • If you add a meeting room to your encrypted event you must join the encrypted video call from your own device, not a meeting room device.
   • You can only add encrypted attachments to an encrypted event.
5. Click Save.

Turn on CSE for an instant meeting

Important: Only hosts can add CSE when creating meetings.

1. Go to meet.google.com.
2. Click Start a new meeting Video call options.
3. In the window that appears, go to the “Security” tab and check the box next to “Add encryption ” then select an option:
   1. To get joining info for an encrypted call later, click Create a video call for later.
   2. To get joining info for an encrypted call instantly, click Start a video call now.

Join a meeting as an external participant

Invitees who aren’t part of your organization will be prompted to validate their identity using a method supported by the Identity Provider. Authentication methods vary between providers.

Some common options include log in with an account such as Google or Microsoft, or receive an email with a one-time password.

Tip: External participants can only join a CSE meeting via computer.

Find out if CSE is turned on for a meeting

Important: Only hosts can add CSE to their meetings.

So you know when CSE is on, a shield appears.

Before the meeting, the shield appears:

• Next to the “Join with Google Meet” button in a Google Calendar invite.
• Next to the meeting on your agenda at meet.google.com or in the Meet app .
• In a banner at the top of the green room window.

During the meeting, the shield appears at the top left hand corner of the meeting window.