Google Workspace CSE: separate control over encryption

What client-side encryption changes

Google Workspace Client-side encryption, CSE, adds an extra layer of encryption to content in supported services and features. The organisation uses an external key service and an identity solution to control access to the protected content.

This differs from relying solely on the encryption the provider manages by default. However, it does not automatically cover all information, metadata or functions in Workspace. Availability and support depend on factors including the licence, application and client.

Three parts need to work together

• The key service: which policies and permissions determine whether content can be decrypted?
• Identity: how is the user verified, and how are changed or closed accounts handled?
• The workflow: which clients, collaboration features and external recipients need to participate?

Test collaboration and recovery

Run a pilot using the document types and workflows you actually use. Check sharing, access from different clients and what happens when someone leaves the organisation. Also plan for export, backup and recovery of both content and the necessary key material.

The availability of the external key service becomes part of the user experience. Describe how an outage affects work and which contact channels apply.

Start with the information's needs

Start with the information that needs separate control and the groups that will use it. A clearly defined scope makes the benefits and limitations easier to understand. Complior can discuss external key management for your environment; the specific service must be matched to Google's current CSE support.