This content was last updated in April 2025, and represents the status quo as of the time it was written. Google's security policies and systems may change going forward, as we continually improve protection for our customers.
At Google, our security controls help protect your data—whether it is traveling over the internet, moving within Google's infrastructure, or stored on our servers. Central to Google's security strategy are authentication, integrity, and encryption, for both data at rest and data in transit. This paper describes how we designed Google Cloud to encrypt data in transit from the internet and data in transit within Google's networks. This document doesn't apply to data in transit over interconnects between customer data center networks and Google's data center networks.
Encryption in transit uses various technologies to help protect data, including transport layer security (TLS), BoringSSL, application layer transport security (ALTS), and the PSP security protocol. In addition to the default protection that Google provides, you can further protect data by adding encryption options such as IPsec, managed TLS certificates, and Cloud Service Mesh.
This document is aimed at CISOs and security operations teams using or considering Google Cloud. This document assumes a basic understanding of encryption and cryptographic primitives.
Authentication, integrity, and encryption
Google employs the following security measures to help ensure the authenticity, integrity, and privacy of data in transit:
- Authentication verifies the identity of a peer (either a human or a process) in a connection.
- Integrity prevents data that you send from being altered while in transit between the source and the destination.
- Encryption uses cryptography to make your data unreadable while in transit and keep it confidential.
Encryption in transit helps protect your data if communications are intercepted while data moves between the end user and Google Cloud or between two services. Encryption in transit authenticates the endpoints and encrypts the data before transmission. On arrival, the receiver decrypts the data and verifies that it was not modified during transit.
Encryption is one component of a broader security strategy. Encryption in transit defends your data against potential attackers and removes the need for Google, Google Cloud customers, or end users to trust the lower layers of the network.
How traffic gets routed
This section describes how requests get from an end user to the appropriate Google Cloud service or customer application, and how traffic is routed between services.
A Google Cloud service is a modular cloud service that we offer to our customers. These services include compute, data storage, data analytics, and machine learning. For example, Cloud Storage is a Google Cloud service.
A customer application is an application hosted on Google Cloud that you, as a Google customer, can build and deploy using Google Cloud services. Customer applications or partner solutions that are hosted on Google Cloud are not considered Google Cloud services. For example, an application you build using Cloud Run, Google Kubernetes Engine, or a VM in Compute Engine is a customer application.
The following diagram shows traffic paths from the end user to Google, paths within Google's network, and the security for each connection. The following traffic paths are shown:
- End user on the internet to a Google Cloud service (labeled A in the diagram)
- End user on the internet to a customer application that is hosted on Google Cloud (labeled B in the diagram)
- Virtual machine to virtual machine (labeled C in the diagram)
- Virtual machine to Google Front End (GFE) (labeled D in the diagram)
- GFE to Google APIs and services (labeled E in the diagram)
- Google Cloud service to Google Cloud service (labeled F in the diagram)
Encryption in transit between the end user and Google
The following sections provide more detail about the end-user routing requests that are shown in the preceding diagram.
End user to a Google Cloud service
Google Cloud services such as Cloud Storage or Compute Engine are cloud services that we offer to customers and run in our production environment. Google Cloud services accept requests from around the world using a globally distributed system called Google Front End (GFE). GFE terminates traffic for incoming HTTP(S), TCP, and TLS connections; provides DDoS attack countermeasures; and routes and load balances traffic to the Google Cloud services themselves. GFE points of presence exist around the globe with paths that are advertised using unicast or Anycast.
GFE routes traffic from an end user over Google's network to a Google Cloud service, and from an end user to a customer application that is hosted on Google Cloud and uses Cloud Load Balancing.