69 CSE with Google-partner KACLS

draft

Client-side encryption encrypts content in the browser before it reaches Google, using a key wrapped by an external key access control list service (KACLS) run by a partner — FlowCrypt, Fortanix, Futurex, Hitachi Solutions, Stormshield, Thales, Utimaco. Google stores only ciphertext and never holds the key, so it cannot read the content and cannot be compelled to produce it. Setting it up needs the KACLS URL plus a separate identity provider that the KACLS trusts to authorise key unwrapping: a second trust anchor, distinct from Workspace sign-in.

Documentation: About client-side encryption ↗ · Choose your key service for client-side encryption ↗

Caveats

CSE breaks everything that reads content server-side¹
A partner KACLS makes the partner, not you, the compelled-disclosure boundary²
Losing the KACLS or its IdP binding is unrecoverable data loss³
Requires Enterprise Plus, Education Standard/Plus or Frontline Plus⁴

Setup steps

Data › Compliance › Client-side encryption › Key services
Add the partner KACLS (key access control list service — e.g. FlowCrypt, Fortanix, Futurex, Hitachi Solutions, Stormshield, Thales, Utimaco) by name and URL, and assign it as the default key service for the OU (organizational unit).

Add key service: name + KACLS URL; assign as default at the OU level

Add and manage key services for client-side encryption ↗
Data › Compliance › Client-side encryption › Identity provider
Connect the identity provider the KACLS will use to authorise key unwrapping — this is a second, separate trust anchor from Workspace sign-in.

IdP configuration (IdP name, client ID, discovery URI) per the partner's instructions

Connect to your identity provider for client-side encryption ↗
open ↗

https://admin.google.com/ac/cse · captured 2026-07-15

Data › Compliance › Client-side encryption
Assign CSE to the target population under 'Encryption with external key service'.

Assign > select OU or group > key service = the partner KACLS > On for Drive/Docs, Gmail, Meet, Calendar as required

Assign client-side encryption to users ↗ Turn client-side encryption on or off for users ↗
Data › Compliance › Client-side encryption
Verify by creating a client-side-encrypted document as a member of the OU and confirming the shield indicator plus that Drive search cannot find its contents.

CSE indicator present; content not indexed

Changes take up to 24 hours to propagate — a same-day verification attempt can look like a broken configuration.

Ongoing maintenance

automatable: script Continuously: monitor KACLS availability — when it is down, every CSE document is unreadable.

How to verify

Open a CSE-encrypted document as an authorised user (key fetch must succeed), then as an unauthorised user (it must fail).

Probe the partner KACLS endpoint availability from outside.

curl -s -o /dev/null -w "%{http_code}" https://<kacls-endpoint>/status

draft v0.0.3 Prevent edition Ent Plus, Edu Std/Plus, Frontline Plus policy #16 · #15, #23 ↗