High Level Architecture
The Google Workspace CSE library enables encryption operations within the client, storing only encrypted files and encrypted keys on the Google Workspace servers. End user authentication is provided by a third-party identity provider.
Google Workspace CSE allows the user to secure Docs, Sheets, and Slides data inside a Drive with an external encryption key maintained by the KACLS.
The following diagram shows the high level architecture:
