Asynchronous Vision API methods do persist data to disk temporarily
(see Data Usage FAQ). These methods are automatically
CMEK-compliant, with no configuration required:
Before Vision API writes data to disk, the data is automatically
encrypted using an ephemeral key called a data-encryption key (DEK). A
new DEK is automatically generated for each asynchronous annotation request.
The DEK itself is encrypted by another key called the key encryption key (KEK).
The KEK is not accessible to Google engineers or support staff.
When the ephemeral key (DEK) that was used to encrypt
its temporary data is destroyed, the temporary data can no longer be
accessed, even if the data hasn't been deleted yet.
Vision API writes the results of a batch annotation request to your
Cloud Storage bucket, which also has support for CMEK. It is recommended
to set up a default encryption key on your input and output
buckets.
For more information about data usage in Vision API, see the
Data Usage FAQ.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[],[],null,["# CMEK compliance in Vision API\n\nBy default, Google Cloud automatically [encrypts data when it is at\nrest](/security/encryption/default-encryption) using encryption keys\nmanaged by Google.\n\nVision API has two batch asynchronous annotation requests:\n[AsyncBatchAnnotateImages](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.AsyncBatchAnnotateImages) and\n[AsyncBatchAnnotateFiles](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.AsyncBatchAnnotateFiles). These methods store\nyour data on disk internally during processing (see the\n[Data Usage FAQ](/vision/docs/data-usage) for more information). The rest of this topic\ndescribes CMEK compliance in Vision API, and how this temporary\ndata is protected at rest. For more information about CMEK in general, see the\n[Cloud Key Management Service documentation about CMEK](/kms/docs/cmek).\n\nHow CMEK compliance works in Vision API\n---------------------------------------\n\nIn Vision API, batch annotation request methods are either\nsynchronous or asynchronous.\n\n- Synchronous Vision API methods don't persist data to disk and thus are\n automatically CMEK-compliant, with no configuration required:\n\n - [BatchAnnotateImages](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.BatchAnnotateImages)\n - [BatchAnnotateFiles](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.BatchAnnotateFiles)\n- Asynchronous Vision API methods do persist data to disk temporarily\n (see [Data Usage FAQ](/vision/docs/data-usage)). These methods are automatically\n CMEK-compliant, with no configuration required:\n\n - [AsyncBatchAnnotateImages](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.AsyncBatchAnnotateImages)\n - [AsyncBatchAnnotateFiles](/vision/docs/reference/rpc/google.cloud.vision.v1#google.cloud.vision.v1.ImageAnnotator.AsyncBatchAnnotateFiles)\n\nBefore Vision API writes data to disk, the data is automatically\nencrypted using an ephemeral key called a data-encryption key (DEK). A\nnew DEK is automatically generated for each asynchronous annotation request.\n\nThe DEK itself is encrypted by another key called the key encryption key (KEK).\nThe KEK is not accessible to Google engineers or support staff.\n\nWhen the ephemeral key (DEK) that was used to encrypt\nits temporary data is destroyed, the temporary data can no longer be\naccessed, even if the data hasn't been deleted yet.\n\nVision API writes the results of a batch annotation request to your\nCloud Storage bucket, which also has support for CMEK. It is recommended\nto set up a [default encryption key](/storage/docs/encryption/using-customer-managed-keys#using_default_encryption_keys) on your input and output\nbuckets.\n| **Note:** CMEK keys are not supported for [Product Search](/vision/product-search/docs).\n\nFor more information about data usage in Vision API, see the\n[Data Usage FAQ](/vision/docs/data-usage).\n\nWhat's next?\n------------\n\n- Learn more about [Batch annotation requests](/vision/docs/batch)\n- Learn more about [CMEK](/kms/docs/cmek)\n- Learn more about [Cloud KMS](/kms/docs)"]]
