Stay organized with collections
Save and categorize content based on your preferences.
This page discusses client-side encryption, which is any data encryption
you perform prior to sending your data to Cloud Storage.
When you perform client-side encryption, you must create and manage your own
encryption keys, and use your own tools to encrypt data prior to
sending it to Cloud Storage. Data that you encrypt on the client side
arrives at Cloud Storage in an encrypted state.
Google Distributed Cloud (GDC) air-gapped has no knowledge of the keys you use to encrypt the
data.
When GDC receives your data, it encrypts the data a
second time. This second encryption is server-side encryption, which
GDC manages. When you retrieve your data,
GDC removes the server-side layer of encryption. You
must decrypt the client-side layer yourself.
Use multiple encryption methods
Depending on your requirements, use more than one encryption method at
a time. For example:
Use a KMS to protect appliance nodes and also use a drive
security feature to double encrypt data on
the self-encrypting drives in the same appliances.
Use a KMS to secure data on appliance nodes and also an option to encrypt all objects when they are
ingested.
If only a small portion of your objects require encryption, consider
controlling encryption at the bucket or individual object level instead.
Enabling multiple levels of encryption has an additional performance cost.
GDC data encryption
GDC Storage encrypts your data on the server side,
before it writes the data to disk, at no additional charge. Besides this
standard, Google-managed behavior, there are additional ways to encrypt your
data when using GDC Storage.
An encryption option available to you is the client-side encryption, an
encryption that occurs before data goes to GDC Storage.
Such data arrives at GDC Storage encrypted, and
undergoes server-side encryption.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eClient-side encryption involves encrypting data before sending it to Cloud Storage, requiring users to manage their own encryption keys and tools.\u003c/p\u003e\n"],["\u003cp\u003eData encrypted on the client side arrives at Google Distributed Cloud (GDC) in an encrypted state and is then encrypted a second time by GDC using server-side encryption.\u003c/p\u003e\n"],["\u003cp\u003eGDC has no knowledge of client-side encryption keys, making secure key management essential; losing these keys results in permanent data inaccessibility.\u003c/p\u003e\n"],["\u003cp\u003eMultiple encryption methods can be used simultaneously, such as combining KMS protection with drive security features, but enabling multiple levels of encryption has an additional performance cost.\u003c/p\u003e\n"],["\u003cp\u003eGDC encrypts data on the server side by default, but client side encryption offers another layer of encryption, before the data makes it to GDC.\u003c/p\u003e\n"]]],[],null,["# Client-side encryption\n\n| **Important:** To access the URLs listed on this page, you must connect to the internet. The URLs are provided to access outside of your air-gapped environment.\n\nThis page discusses *client-side encryption*, which is any data encryption\nyou perform prior to sending your data to Cloud Storage.\n\nWhen you perform client-side encryption, you must create and manage your own\nencryption keys, and use your own tools to encrypt data prior to\nsending it to Cloud Storage. Data that you encrypt on the client side\narrives at Cloud Storage in an encrypted state.\nGoogle Distributed Cloud (GDC) air-gapped has no knowledge of the keys you use to encrypt the\ndata.\n\nWhen GDC receives your data, it encrypts the data a\nsecond time. This second encryption is *server-side encryption*, which\nGDC manages. When you retrieve your data,\nGDC removes the server-side layer of encryption. You\nmust decrypt the client-side layer yourself.\n| **Warning:** GDC does not know if your data has already encrypted on the client side and has no knowledge of your client-side encryption keys. You must securely manage your client-side keys and ensure that they are not lost. If you lose your keys, you are no longer able to read your data. You continue to receive charges for storage of your objects until you delete them.\n\nUse multiple encryption methods\n-------------------------------\n\nDepending on your requirements, use more than one encryption method at\na time. For example:\n\n- Use a KMS to protect appliance nodes and also use a drive security feature to *double encrypt* data on the self-encrypting drives in the same appliances.\n- Use a KMS to secure data on appliance nodes and also an option to encrypt all objects when they are ingested.\n\nIf only a small portion of your objects require encryption, consider\ncontrolling encryption at the bucket or individual object level instead.\nEnabling multiple levels of encryption has an additional performance cost.\n\nGDC data encryption\n-------------------\n\nGDC Storage encrypts your data on the server side,\nbefore it writes the data to disk, at no additional charge. Besides this\nstandard, Google-managed behavior, there are additional ways to encrypt your\ndata when using GDC Storage.\n\nAn encryption option available to you is the client-side encryption, an\nencryption that occurs before data goes to GDC Storage.\nSuch data arrives at GDC Storage encrypted, and\nundergoes server-side encryption.\n| **Warning:** If you use client-side encryption, you must securely manage your keys and ensure they are not lost. If you lose your keys, you can no longer read your data. GDC continues to charge you for the storage of your objects until you delete them."]]
