48 CSE self-hosted / HYOK KACLS

Caveats

• The payoff is near-total against a compelled-provider threat and near-zero against anything else¹
• If your KACLS is unreachable, encrypted content is unreadable²
• CSE breaks server-side features on the encrypted content³
• Tenant-wide CSE is an operational cliff, not a security win⁴
• Requires Enterprise Plus, Education Standard or Plus, or Frontline Plus⁵

Setup steps

1. open ↗

   

   https://admin.google.com/ac/cse · captured 2026-07-15

   Data › Compliance › Client-side encryption › Key service ↗

   Register your self-hosted KACLS (key access control list service) endpoint. Self-hosted (HYOK, 'hold your own key') means you run the key service; Google never sees the key — that is the entire threat-model payoff.

   Add key service → Name + KACLS URL (your endpoint, e.g. https://kacls.example.org/v1)

   Add and manage key services for client-side encryption ↗ Build a custom key service for client-side encryption ↗

2. Data › Compliance › Client-side encryption › Identity provider

   Register the external IdP that the KACLS will trust for authorisation assertions — CSE requires the IdP+key-service pair, not the key service alone.

   .well-known/cse-configuration file on your domain (or the Admin console IdP fallback): name, client_id, discovery_uri (OIDC discovery URL), grant_type, applications

   Connect to your identity provider for client-side encryption ↗

3. Data › Compliance › Client-side encryption › Assign to users

   Assign the registered key service to the OU (organizational unit) or group that holds the crown jewels — adding the key service alone does not scope it to the OU; the assignment does. Tenant-wide CSE is an operational cliff, not a security win.

   Key service assigned to the high-risk OU/group only

   Assign client-side encryption to users ↗

4. Data › Compliance › Client-side encryption ↗

   Turn on Client-side encryption status per service for that OU — the CSE screen's per-service toggles (Drive, Gmail, Calendar, Meet), as in №69 — so users can create client-side-encrypted files. This per-service toggle is the only CSE on/off switch for users.

   Client-side encryption status = On for Drive (Docs/Sheets/Slides fall under Drive; add Gmail, Calendar, Meet as needed) for the high-risk OU; Off elsewhere

   Turn client-side encryption on or off for users ↗

Ongoing maintenance

• automatable: script Continuously: operate, patch and monitor the KACLS host — its downtime bricks every CSE document.
• requires a human Quarterly: test KACLS key-material backup restore.

How to verify

1. Probe the self-hosted KACLS from outside, then open a CSE document as an authorised user and confirm the key operation appears in the KACLS’s own logs — the log line is the point of HYOK.

   curl -s -o /dev/null -w "%{http_code}" https://<kacls-host>/status