Google's beta connects Workspace client-side encryption (CSE) to the Google Workspace rules engine. An administrator writes a data protection rule, and matching files in My Drive and shared drives are encrypted in place, keeping their original URLs. Supported types include Docs, Sheets, Slides, Microsoft Office files, PDFs and images. Before this, users had to make encrypted copies of existing files by hand and remember to delete the unencrypted originals.

How policy-based encryption works

CSE adds a layer on top of the default encryption Google Workspace provides. It relies on two services your organization chooses and configures: an identity provider that verifies each person, and an external key service, called a Key Access Control List Service (KACLS), that controls the top-level keys. Google says its servers cannot access your keys or decrypt the content.

Normally CSE encrypts content in the person's browser before it reaches Google. A rule works in the background without anyone opening the file, so Drive generates a data encryption key for each flagged file, encrypts the content with it and sends that key to your KACLS's automated systemwrap endpoint to be wrapped. Google says it never logs or stores the unwrapped key, and the original unencrypted data is deleted on the Workspace data retention timeline. Until the scan reaches an unencrypted file, it has only Google's standard encryption in transit and at rest.

In Google's CSE design, the key service returns the wrapped key to be stored with the encrypted file. When someone opens the file, Workspace sends an unwrap request to your KACLS, which validates that person's authentication and authorization tokens before returning the key. Because opening a file depends on that request, treat the key service's availability as seriously as Drive's. Google's FAQ adds that you can revoke a user's access to keys, even keys that user generated.

The announcement names ITAR, EAR and HIPAA among the compliance mandates the feature is meant to help organizations satisfy. Whether it meets a specific obligation depends on your own requirements, so confirm that with whoever owns compliance before you rely on it.

What you give up

Because Google's servers cannot read the content, encrypted files are not scanned for phishing and malware. Data loss prevention rules can check only unencrypted metadata, such as titles and Drive labels, plus whether a file is client-side encrypted. Google Vault can retain and export encrypted files and search them by metadata such as title and owner, but it cannot search their content, search by file type or preview them.

Day-to-day work changes too. Google's help pages list these limits for encrypted files:

  • Only one person can edit at a time, so there is no real-time co-editing.
  • Files can be shared only with viewer or editor access, because the commenter role is not supported.
  • Suggestions in Docs, grammar check, voice typing and add-ons are unavailable.
  • Slides cannot be printed, and Docs and Slides cannot be downloaded.
  • Encrypted Docs, Sheets and Slides files are capped at 100 MB.
  • On a computer, people need Chrome or Microsoft Edge to view or edit encrypted content.
  • On phones and tablets, encrypted content is view-only and limited to non-Google formats such as PDFs.

Check whether you qualify

The announcement offers the beta to Enterprise Plus customers with the Assured Controls or Assured Controls Plus add-on who apply through Google's Policy-Based Enforcement beta application and are allowlisted. Google's setup article also lists Education Standard and Education Plus. The feature is off by default and available on both Rapid Release and Scheduled Release domains, and allowlisted domains receive onboarding and configuration documentation.

Assured Controls is a paid add-on, and Google says to contact Google Workspace sales to get it. Business editions are not among the editions Google lists for CSE, so an organization on Business Starter, Business Standard or Business Plus would need a different edition first. To see your edition, go to Menu, then Billing, then Subscriptions in the Admin console, which requires the Billing management privilege.

Eligibility is not the same as fit. Google describes CSE as especially useful for organizations that hold sensitive or regulated data, such as intellectual property, healthcare records or financial data. The beta suits an organization that must keep specific files unreadable to its cloud provider and can give up the features above for those files.

Line up the prerequisites and roles

If you qualify, Google's setup article lists these prerequisites:

  • Assured Controls or Assured Controls Plus licenses for the organizational units or groups the rule will cover.
  • CSE for Drive set up with an identity provider and a key service, and turned on for those units or groups.
  • A key service whose provider confirms that the systemwrap endpoint is supported and turned on.
  • Admins with the View DLP rule and Manage DLP rule privileges.

Other roles come into play. Managing CSE, its key services and who has CSE turned on takes a super administrator, and CSE itself is configured under Menu, then Data, then Compliance, then Client-side encryption. Google's DLP help says a delegated admin who manages rules also needs Organizational unit and Groups administrator privileges, plus the investigation tool's View Metadata and Attributes privilege to review rule results. Creating labels in the Label manager takes the Manage Classification Labels privilege, and the Alert center needs the Alert center administrator privilege.

For the key service, Google's FAQ lists Cloud HSM for Google Workspace, partner services and services built with the Workspace CSE API. You can run more than one and assign each to an organizational unit or group.

Decide which files belong in scope

A rule can match on Drive labels, titles or content. Labels, which the Admin console's Label manager calls classification labels, are the most predictable trigger when you already know which files are sensitive, because the scanner reads them as metadata and they stay readable to rules after a file is encrypted. Content conditions suit sensitive data scattered across many files.

Content conditions have blind spots. Google's DLP documentation says comments, the contents of password-protected files, and video and audio files are not scanned. For files that are not in Google formats, DLP extracts content only from files up to 50 MB, and it analyzes only the first 10 MB of extracted text. A file whose sensitive material sits in any of those places needs a label or title match instead.

Labels need controls of their own. Google's labels help says everyone in the organization can view and apply labels by default, so set the trigger label to Restricted access for the people who classify these files. Drive rules can use only labels with a badged field or a single-select options list, and confidential details should stay out of label names, which admins with label privileges can see.

Default classification does not label existing files unless the owner changes, so on its own it will not label files already in Drive. A label used in a data protection rule also cannot be disabled or deleted.

Know what encryption removes from a file

While a file converts, it is temporarily locked for editing. Container-bound Apps Script automations and linked Google Forms stop running and are permanently removed from the file. For Docs, Sheets and Slides, the latest revision is kept and encrypted, and earlier unencrypted revisions are deleted. Comments in those files are kept, but comments in Microsoft Office files are permanently removed.

Removed content goes to encrypted takeout files in a time-stamped folder in the same location as the file. Google's user help, describing encryption a person adds by making an encrypted copy, lists more features that are made static, such as checklists, embedded drawings, charts and tables, Connected Sheets and external data functions like GOOGLEFINANCE. It also lists features that are removed, such as e-signature fields and protected ranges. The rules article does not repeat that list, so check those features during the pilot.

Find the files that depend on these features, or on commenters or editing from phones, before the rule does. Encrypted files keep up to 100 versions in version history, and named versions are not available.

The unchanged link still needs testing

A stable link matters because teams use it in tickets, shared documents and project notes. The main thing to test is what happens to people's access after a file is encrypted. An existing link can still point to the same file even when the people who can open it, or the ways they can work with it, have changed.

People who open a converted Docs, Sheets or Slides file see a message that their administrator applied additional encryption, with a link to the security limitations. PDFs, images and Google files can be previewed, while other types need Download and decrypt.

Inside your organization, any Google Workspace or Cloud Identity license is enough to view and edit encrypted content, but each person must also be on the key service's access control list. Check that list against the sharing settings of every file in the pilot.

Outside collaborators are the hardest case. If their organization also uses CSE, its identity provider, and any separate web and mobile client IDs it needs, must be allowlisted with your key service, and its users need a Workspace or Cloud Identity license. Consumer Google Accounts and visitor accounts cannot use that route. Their admin should also know that signing in requires their users to share IP addresses and other identity information with your key service.

A guest identity provider covers everyone else, including people whose organizations do not use CSE and people without a Workspace or Cloud Identity license. It is set up with the Configure guest IdP option in the Admin console, and for Drive and the Docs editors it must be a third-party provider rather than Google identity. Google says it currently works only in web apps, and that a CSE-to-CSE setup is ignored once a guest identity provider is configured.

Run an audit-only rule first

Google's DLP help recommends testing with an audit-only rule, which has no action and only logs matches. To build one:

  • In the Admin console, go to Menu, then Security, then Access and data control, then Data protection.
  • Click Manage rules, then Add rule, then New rule, enter a name and check Google Drive.
  • In the Actions section, leave the action unselected.
  • For scope, choose Organizational units and/or groups and pick a small pilot.
  • Add a content condition such as Drive labels, Title or All content, matched with predefined detectors, word lists or regular expressions.
  • Set Rule status to Active and click Create.

Conditions can be combined with AND, OR and NOT, and predefined detectors take settings such as Likelihood Threshold and Minimum unique matches. Scope groups must use your organization's domain, and if an organizational unit and a group conflict, the group takes precedence.

Scanning can take a few hours, a day or longer. My Drive files follow the policy that applies to the file owner, while shared drive files follow the drive's assigned organizational unit or group, regardless of who created the file.

When the matches are right, edit the rule and add the Apply client-side encryption action. Under Alerting you can choose a severity, check Alert center and add email recipients. Review the potential impact message, click I understand in the Acknowledgement of impact on data box, then click Update, keep the rule Active and click Complete.

Editing a rule starts a new scan of the files it covers, and Google says rule changes can take up to 24 hours to apply. Alerts are capped at 50 per rule per day, so count results in the investigation tool rather than in alert emails.

Verify the result

After switching encryption on, check the work:

  • In Security center, open the Investigation tool, set the data source to Rule log events, add a Rule name condition and search.
  • Confirm that Content matched covers the expected files and that Encryption change applied shows Succeeded for Event status.
  • For a single file, switch to Drive log events and look for an Encrypt event with DLP Rule as the actor.
  • Open converted files as an editor, a viewer and an outside collaborator, and confirm nothing that should run has stopped.

A second audit-only rule exposes gaps. Give it the same scope and label or content condition, joined with AND to the condition File encryption status Is not client-side encrypted, which Google's FAQ documents. Its matches are files that should have been encrypted but were not.

If Google cannot reach your key service, the file stays unencrypted and the Alert center raises a Client-side encryption service unavailable alert. Filter by that alert type, and each alert shows the endpoint that was called and an HTTP status code such as 401, 403 or 500. After fixing the cause, open the rule, click Client-side encryption rescan, then Start rescan, and check for Succeeded again.

Undo a mistake with a decrypted copy

To undo a mistake in Docs, Sheets or Slides, choose File, then Make a copy (in Slides, Entire presentation), and select Remove additional encryption. For other files, right-click the file in Drive and choose Make a copy, then Make a decrypted copy. If the option is missing, Google's help says to confirm you own the file in My Drive or are a Manager of its shared drive.

Either way you get a new file with a new link, because Google's help describes removing encryption only through a copy. Correct the label or condition that caused the match first, then confirm the rule does not pick up the copy.

Common mistakes and how to spot them

The most damaging mistake is adding the action to a rule with no condition, which Google's DLP overview says applies to all shared or modified Drive files. In the audit stage it shows up as a match count far above the number of files you expected.

A trigger label applied too freely produces false matches, such as marketing files labeled by habit. Review each match in Rule log events for files that should not hold controlled data, then tighten who can apply the label.

If a shared drive you know holds labeled files contributes no matches, compare the drive's assigned organizational unit or group with the rule's scope. If a known sensitive file is missing, check it against the scanning blind spots above.

Clear-text copies undo the protection. Besides the Drive for desktop trap covered below, Google's help warns that apps with enough permissions, such as Chrome extensions, may be able to view and exfiltrate encrypted files, and that encryption does not protect a file from someone who can see your screen. Encrypted files show a lock icon in Drive, so a controlled file without one deserves a look. Because titles stay readable, keep sensitive details out of file names.

What to tell staff

Before the pilot, walk the people in it through the limits above and tell them:

  • The lock icon and the administrator message are expected, and a file may be temporarily locked while it converts.
  • Wait to edit means someone else is editing, and Safe to edit means you can start.
  • Autosave runs every 30 seconds while you work, so wait for Saved to Drive before closing a file.
  • Opening encrypted files may require signing in to the company's identity provider as well as to Google.
  • Never save a decrypted download into a folder that Drive for desktop syncs, or it ends up in Drive in clear text.
  • Use Chrome's Basic spell check, not Enhanced spell check, which sends data to Google.

A worked example

Imagine a 30-person machine shop that handles export-controlled drawings, already has Enterprise Plus, Assured Controls and CSE, and has been allowlisted for the beta. Its IT lead publishes a label with a single-select options field for controlled drawings, restricts who can apply it to the engineers, and writes an audit-only rule matching that label. The rule is scoped to the Engineering organizational unit, which holds five engineers and the drawings shared drive.

A day later, Rule log events show 40 matches. Two are sales brochures an engineer labeled by mistake, so the label comes off. One spreadsheet runs a container-bound Apps Script reminder that encryption would remove, so its owner moves the reminder to a separate file that holds no controlled data. The IT lead changes two estimators who only comment to viewer access, and a supplier's engineer opens a test file in a web browser through a guest identity provider.

The IT lead then adds the encryption action with Alert center alerting. Thirty-six of the 38 labeled files show Succeeded, while the other two stay unencrypted and the Client-side encryption service unavailable alert shows a 403 status code. After the key provider corrects its configuration, a rescan brings all 38 to Succeeded and the gap-check rule comes back empty. She records who holds Manage DLP rule before widening the scope.

Short answers to common questions

Shared drives need no separate CSE setup. Google's FAQ says the key service you set up works for files in both My Drive and shared drives.

Leaving CSE entirely is an export project. Google's FAQ says to export the items with the Data Export tool and then remove CSE with the decrypter command-line utility, the same tool used to decrypt Vault exports. Users whose licenses no longer include CSE can still access and edit encrypted items but cannot create new ones.

There is no end-user setting. Staff do not opt in or out, and the rule decides which files convert.

What to do this week

Start with the first item, and take on the rest if you qualify:

  • Check your subscriptions for Enterprise Plus, Education Standard or Education Plus, and an Assured Controls add-on.
  • If you qualify and want the beta, ask your key service provider to confirm systemwrap support before you apply.
  • List likely matches that use Apps Script, linked forms, e-signature fields, protected ranges or Office comments, or that are shared with commenters.
  • Write down who holds super administrator, Manage DLP rule and Manage Classification Labels, and who approves rule changes.
  • Choose a few non-production files and the people who normally edit, view and share them, then test one misclassified file and one outside collaborator.

Where ALCO can help

ALCO's services include Google Workspace administration for Gmail, Drive, Calendar and the admin console, cybersecurity and compliance, and user training. For an existing tenant, ALCO's Google Workspace service starts with an audit of users, security, mail authentication, sharing and licenses, and you get a short written report. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources