您可以使用自己的加密密钥来加密组织的数据，而不是使用 Google Workspace 提供的加密密钥。使用 Google Workspace 客户端加密功能 (CSE) 时，系统会在将文件存储到云端硬盘的云端存储空间之前，先在客户端的浏览器中对文件进行加密。使用这种方式时，Google 服务器无法访问您的加密密钥，因此也无法解密您的数据。如需了解详情，请参阅客户端加密功能简介。
借助此 API，您可以使用自定义的外部密钥服务来控制可保护数据的顶级加密密钥。使用此 API 创建外部密钥服务后，Google Workspace 管理员可以连接到该服务，并为用户启用 CSE。
重要术语
以下是 Google Workspace Client-side Encryption API 中使用的常见术语列表：
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["没有我需要的信息","missingTheInformationINeed","thumb-down"],["太复杂/步骤太多","tooComplicatedTooManySteps","thumb-down"],["内容需要更新","outOfDate","thumb-down"],["翻译问题","translationIssue","thumb-down"],["示例/代码问题","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-04。"],[[["Google Workspace Client-side Encryption (CSE) allows you to encrypt your organization's data with your own keys, preventing Google servers from accessing or decrypting it."],["This API enables you to manage the encryption keys via an external key service, giving you control over data access."],["CSE encrypts files in the user's browser before they are stored in Google Drive, ensuring only authorized users with access to your external key service can decrypt them."],["When a file is encrypted, Google Workspace generates a Data Encryption Key (DEK), which is then encrypted by your external key service and stored with the encrypted data."],["To get started, you can configure your external key service and learn how to encrypt and decrypt data using the provided guides."]]],["Google Workspace Client-side Encryption (CSE) allows users to encrypt data in their browser before cloud storage. This is achieved by using your own external Key Access Control List Service (KACLS). Google Workspace generates a Data Encryption Key (DEK) and sends it to your KACLS for encryption with a Key Encryption Key (KEK). Your service then returns the encrypted DEK to Google Workspace. This ensures that only users with KACLS access can decrypt the stored data.\n"]]
