Supported editions for this feature: Frontline Plus; Enterprise Plus; Education Standard and Education Plus. Compare your edition
Requires having the Assured Controls or Assured Controls Plus add-on.
If you haven't set up Google Workspace Client-side encryption (CSE), you can use an automated provisioning process that sets up CSE with minimal engineering support. This automated setup uses Cloud Hardware Security Module (HSM) for Google Workspace as your key service. It also sets up Google Identity as your identity provider (IdP) and as the guest IdP for external collaboration.
If your environment requires it, you can use the standard CSE setup instead. The standard setup might take several days and require multiple interactions with Google Workspace support.
Automated setup can only be completed once. If you need to make additional changes after completing an automated setup, you must use the standard CSE setup.
Set up CSE using automatic key service & IdP provisioning
Before you begin: Ensure that you meet the following prerequisites in the Google Cloud console:
- Accepted the Google Cloud Terms of Service.
- Ensured a Google Cloud Organization exists for the Workspace domain. You can check if your organization exists using the project picker in the Google Cloud console.
- Have the Organization Administrator role at the organization level. For details on viewing roles or adding new roles, go to Check for the roles.
- Set up a valid billing account to pay Cloud HSM costs.
To use the automatic key provisioning process to set up CSE:
-
In the Google Admin console, go to Menu
Data
Compliance
Client-side encryption.You must be signed in as a super administrator for this task.
- For Set up client-side encryption to increase data privacy, click Set up.
On the Key service & identity provider page, click Provision.
The automated setup preselects Google Cloud HSM as your key service and Google Identity as your IdP.
If you chose a region for your data, the Key Access Control List Service (KACLS) is created in that region. Otherwise, the KACLS is created in the U.S. region by default. For details, go to Choose a geographic location for your data.
Check the Cloud HSM cost agreement box.
Click Save & continue.
Select the organizational unit that you want to turn on CSE for.
Select the apps (Gmail, Drive and Docs, Calendar, and Meet) that you want to turn on CSE for.
Click Save.