Google Extends Client-Side Encryption to Additional Gmail Users

Client-side encryption (CSE) is now effectively open for Gmail, following it was made available in Drive, Docs, Slides, Sheets, and Meet last year, and in Calendar in Feb. The company launched a CSE beta for Gmail and Calendar late last year, but the service is now available to all enterprises using a Google Workspace Enterprise Plus, Education Plus, or Education Standard subscription. The feature is not yet accessible for personal Workspace plans or Google accounts.

Despite the fact that Workspace “encrypts data at rest and in transit using secure-by-design cryptographic libraries,” CSE offers enterprises complete control over their encryption keys. “Starting today, users may send and receive emails or schedule meetings with internal colleagues and external parties with the confidence that their sensitive data (including inline photos and attachments) has been encrypted before reaching Google servers,” Google stated in a blog post.

CSE, which is disabled by default, must be enabled by workspace admins. Once enabled for your company, you can add CSE to any Gmail message by clicking the lock symbol to the right of the “To” box and selecting the “Additional encryption” option. The compose panel will go blue, and the message “New encrypted message” will appear. Meanwhile, in Calendar, you can add “extra encryption” to the description, attachments, and Google Meet call by clicking the shield symbol next to the event title.

Although encrypting Drive files and Calendar events is a good addition, CSE safeguards may be most effective in Gmail. After all, organizations are more likely to send emails to third parties than to exchange files or calendar invitations. In that respect, Google claims that CSE now covers all key Workspace apps.