Working with client-side encrypted files in Vault

Vault now supports client-side encrypted files in Drive. Learn more about client-side encryption.

Retention and holds

Vault retains and holds client-side encrypted files in Drive the same as other files in Drive. 


You can search for client-side encrypted files by their metadata, such as title and owner. However, you can’t search their content, search by file type, preview the content, or download from the preview view.

You can search for only client-side encrypted files or exclude these files from your search:

  1. Sign in to
  2. Click Matters and click the matter you want to search in.
  3. For the service, select Drive.
  4. Select the source data, entity, and other options. For details, see Use Vault to search Google Drive, Meet, and Sites.
  5. Click Advanced search options.
  6. Select whether to search all files, only client-side encrypted files, or only non-client-side encrypted files.
  7. Click Search.

In your results list, client-side encrypted files have an Encrypted  icon next to them.


When you export client-side encrypted files, the files remain encrypted and the filenames end with .gcse. To decrypt the files, you'll use Google client-side decrypterNote: When you decrypt a Google Docs, Sheets, or Slides file, the file name ends with .gdoc. The decrypter can’t convert these files to DOCX, XLSX, or PPTX yet.

You can also identify client-side encrypted files by their metadata. These files have ClientSideEncrypted set to true. Files that aren't client-side encrypted don't include the ClientSideEncrypted tag.

Was this helpful?
How can we improve it?
Clear search
Close search
Google apps
Main menu
Search Help Center