Google Implements Client-Side Encryption for Gmail and Calendar Users

Google has recently rolled out client-side encryption (CSE) for some users of Gmail and Calendar.

This innovative security feature allows for a significant improvement in securing confidential correspondence and schedules of events.

The implementation of CSE in Google Workspace means that the administrator of the platform has access to the encryption keys. This stands in contrast to end-to-end encryption, where only the sender and recipient have access, and server-side encryption, which is used when storing data.

The function has already been available for users of Drive, Docs, Presentations, Sheets, and Google Meet messenger, but is now also connected to Gmail and Calendar. The feature ensures that neither Google employees nor any hackers will be able to access user data, providing a guarantee of data security.

However, it's important to note that users do not have sole control over the encryption keys, as only a few services that Google cooperates with issue them.

Google's CSE is a middle ground for organizations that implement encryption to comply with legal or contractual obligations. The feature is a general term for any encryption applied to data before it is sent from the user's device to the server.

“We recognize sovereign controls are important to customers and have accelerated delivery of these encryption capabilities to support our customers in maintaining control over their data and meeting their regulatory compliance needs,” Google wrote in a blog post by Ganesh Chilakapati, group product manager and Andy Wen, director of product management at Google Workspace Security.

It ensures that the data remains unreadable to hackers even if they manage to break into Google's servers. The move is intended to facilitate compliance procedures for private and public sector organizations, which require high levels of encryption for certain types of communication.

Overall, CSE significantly improves data security for Gmail and Calendar users. It ensures that users can send and receive emails or create meeting events with internal colleagues and external parties, knowing that their sensitive data has been encrypted before it reaches Google servers.

Client-side encryption, including for Gmail and Calendar, is available to customers worldwide with Workspace Enterprise Plus, Education Standard, and Education Plus subscriptions.