How to Configure Client-Side Encryption for Video Meetings in Google Meet

In highly regulated industries such as aerospace, financial services, and healthcare, transmitting confidential intellectual property over cloud collaboration platforms requires cryptographic isolation. While Google Meet natively encrypts all audio and video streams in transit and at rest using Google-managed keys, Google Workspace Client-Side Encryption (CSE) ensures that your organisation retains sole ownership of the encryption keys. When CSE is enabled, Google servers cannot decrypt call media under any circumstances.

How Google Meet Client-Side Encryption Works

Google Workspace CSE decouples data storage and communication infrastructure from cryptographic key governance:

• Key Access Control List (KACL) Service: Encryption keys are held by an external, customer-managed identity provider (such as Fortanix, Thales, Virtru, or a custom private API).
• Browser-Level Encryption: Before audio or video streams depart the participant’s web browser, the client contacts the external key service, retrieves a session key, and encrypts the WebRTC media payload.
• Zero Decryption on Google Relays: Media traversing Google’s global routing infrastructure remains ciphertext, preventing eavesdropping or compliance breaches.

Configuring an External Key Access Service in Google Workspace

Before end users can initiate encrypted calls, administrators must register an authorized KACL service:

1. Sign in to the Google Workspace Admin Console with Super Administrator credentials.
2. In the left sidebar, navigate to Security > Access and data control > Client-side encryption.
3. Under External key access service, click Add service.
4. Provide your key service endpoint URL and upload your identity provider configuration credentials (OpenID Connect / IdP metadata).
5. Assign the service to target Organisational Units (OUs) holding high-security personnel.

Enabling Client-Side Encryption for Google Meet

Once the external key service is authenticated, activate the policy specifically for Meet:

1. In the Admin Console, navigate to Apps > Google Workspace > Google Meet.
2. Click Meet video settings.
3. Scroll down to Client-side encryption.
4. Select your target Organisational Unit from the left tree.
5. Change the setting to Users can turn on client-side encryption for calls or enforce it by selecting Turn on client-side encryption by default.
6. Click Save.

Scheduling and Joining Encrypted Video Calls

End users can now schedule and conduct secure meetings via Google Calendar or directly in Google Meet:

1. Open Google Calendar and create a new meeting invitation.
2. Beside Add Google Meet video conferencing, click the Change conference settings (gear icon).
3. Navigate to the Encryption tab and toggle Add additional encryption to the active position. A padlock shield icon appears on the event.
4. Save and send the invitation to attendees.
5. When participants join the call, their browser prompts them to authenticate against your external identity provider, verifying their identity and decrypting the meeting feed securely.

Deploying Client-Side Encryption in Google Meet satisfies the most rigorous international compliance mandates while preserving smooth, web-based video conferencing.