Google Workspace CSE Resources
Client Side Encryption (CSE) in Google Workspace enables encryption operations within the client, storing only encrypted data and encrypted keys in the cloud. AES symmetric keys are used to encrypt the user content.
Google Workspace CSE allows the users to secure:
Calls over Google Meet
Docs, Sheets, and Slides data inside a Drive
Google Calendar events
Content is secured with an external encryption key that Google servers cannot access. File and call contents are encrypted on the browser before being sent to Google servers for storage.
With Google Workspace CSE:
Key ACL Service (KACLS) controls the top-level encryption keys that protect users' Meet Calls, Calendar event data, Docs, Sheets, and Slides data. KACLS is also referred to as external key management service in this document.
The authorization to encrypt or decrypt an object is created by Google Workspace.
End-user authentication is provided by a third-party identity provider.
Only encrypted files and encrypted keys are sent to Google Workspace servers.
