This content was last updated in May 2024 and represents the status quo as of the time that it was written. Google's security policies and systems may change going forward, as we continually improve protection for our customers.
At Google, our comprehensive security strategy includes encryption at rest, which helps to protect customer data from attackers. We encrypt all Google customer content at rest, without any action required by you, using one or more encryption mechanisms. This document describes our approach to default encryption at rest for Google infrastructure and Google Cloud, and how we use it to keep customer content more secure.
This document is for security architects and security teams who are currently using or considering Google. This document assumes a basic understanding of encryption and cryptographic primitives. For more information on cryptography, see Introduction to Modern Cryptography.
Encryption at rest is encryption that is used to help protect data that is stored on a disk (including solid-state drives) or backup media. All data that is stored by Google is encrypted at the storage layer using the Advanced Encryption Standard (AES) algorithm, AES-256. We use a common cryptographic library, Tink, which includes our FIPS 140-2 validated module (named BoringCrypto) to implement encryption consistently across Google Cloud.
We own and manage the keys used in default encryption at rest. If you use Google Cloud, Cloud Key Management Service lets you create your own encryption keys that you can use to add envelope encryption to your data. Using Cloud KMS, you can create, rotate, track, and delete keys. For more information, see Cloud Key Management Service deep dive.
Keys in Google Cloud
The following table describes the different properties of keys in Google Cloud.
| Type of key | Cloud KMS Autokey | Cloud KMS customer-managed (manual) | Google-owned and Google-managed encryption key (Google default encryption) |
|---|---|---|---|
Can view key metadata |
Yes |
Yes |
No |
Ownership of keys1 |
Customer |
Customer |
|
Key creation and assignment is automated. Customer manual control is fully supported. |
Customer, manual control only |
||
Supports regulatory requirements for customer-managed keys |
Yes |
Yes |
No |
Key sharing |
Unique to a customer |
Unique to a customer |
Data from multiple customers is typically protected by shared key encryption keys (KEKs). |
Control of key rotation |
Yes |
Yes |
|
Yes |
Yes |
No | |
Yes |
Yes |
No |
|
Logical data separation through encryption |