50 CSE self-hosted / HYOK KACLS

Caveats

• The payoff is near-total against a compelled-provider threat and near-zero against anything else — do not deploy HYOK for a threat model that does not include legal compulsion of Google.
• If your KACLS is unreachable, encrypted content is unreadable — you have built your own single point of failure, and key-service uptime is now your uptime.
• CSE breaks server-side features on the encrypted content — no search inside, no Vault indexing, no DLP inspection, no server-side spam scanning.
• Requires Enterprise Plus, Education Standard or Plus, or Frontline Plus — on other editions this screen does not resolve (as with №71).

Setup steps

1. 1. Register your self-hosted KACLS (key access control list service) endpoint. Self-hosted (HYOK, 'hold your own key') means you run the key service; Google never sees the key — that is the entire threat-model payoff.
   open ↗

   

   https://admin.google.com/ac/cse · captured 2026-07-15

   Data › Compliance › Client-side encryption › Key service

   Add key service → Name + KACLS URL (your endpoint, e.g. https://kacls.example.org/v1)

2. 2. Register the external IdP that the KACLS will trust for authorisation assertions — CSE requires the IdP+key-service pair, not the key service alone.

   Data › Compliance › Client-side encryption › Identity provider

   .well-known/cse-configuration file on your domain (or the Admin console IdP fallback): name, client_id, discovery_uri (OIDC discovery URL), grant_type, applications

3. 3. Assign the registered key service to the OU (organizational unit) or group that holds the crown jewels — adding the key service alone does not scope it to the OU; the assignment does. Tenant-wide CSE is an operational cliff, not a security win.

   Data › Compliance › Client-side encryption › Assign to users

   Key service assigned to the high-risk OU/group only

4. 4. Turn on Client-side encryption status per service for that OU — the CSE screen's per-service toggles (Drive, Gmail, Calendar, Meet), as in №71 — so users can create client-side-encrypted files. This per-service toggle is the only CSE on/off switch for users.

   Data › Compliance › Client-side encryption

   Client-side encryption status = On for Drive (Docs/Sheets/Slides fall under Drive; add Gmail, Calendar, Meet as needed) for the high-risk OU; Off elsewhere

Ongoing maintenance

• automatable: script Continuously: operate, patch and monitor the KACLS host — its downtime bricks every CSE document.
• requires a human Quarterly: test KACLS key-material backup restore.

How to verify

1. Probe the self-hosted KACLS from outside, then open a CSE document as an authorised user and confirm the key operation appears in the KACLS’s own logs — the log line is the point of HYOK.

   curl -s -o /dev/null -w "%{http_code}" https://<kacls-host>/status