> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/user-guide/publish-your-docs/google-drive.md).

# Google Drive

### I. Encryption Flow: Creating or Editing a Document

When a user creates or modifies a Google document, the following "Wrap" process occurs:

1. **DEK Generation:** Google generates a unique Data Encryption Key (DEK) specifically for that document.
2. **Content Encryption:** Google encrypts the document content using this local DEK.
3. **Key Protection Request:** Google sends the DEK to Oten KMS for secure protection.
4. **Key Wrapping:** Oten KMS wraps (encrypts) the DEK using your Customer Managed Key (CMK) stored securely in the KMS.
5. **Secure Storage:** Google stores the encrypted document alongside the wrapped DEK. Google never has access to the plain-text CMK or DEK.

{% embed url="<https://app.supademo.com/demo/cmhd2xyjg2dcpfati415mmwv7?utm_source=link>" %}

### II. Decryption Flow: Accessing an Encrypted Document

When an authorized user opens an encrypted document, the following "Unwrap" process occurs:

1. **Data Retrieval:** Google retrieves the encrypted document and the associated wrapped DEK.
2. **Authorization Request:** Google forwards the wrapped DEK to Oten KMS.
3. **Key Unwrapping:** Oten KMS verifies the user's identity and authorization, then unwraps (decrypts) the DEK using the corresponding CMK.
4. **Content Decryption:** Google receives the plain-text DEK and uses it to decrypt the document content in the browser memory.
5. **Seamless Access:** The user views and interacts with the document normally within Google Workspace, ensuring a seamless yet secure experience.

{% embed url="<https://app.supademo.com/demo/cmhd5gj622fhpfatiruptrnnm?utm_source=link>" %}

### III. Maximize feature potential

* To optimize the use of this features across browsers and mobile apps, please configure your settings as follows:
  * For **mobile app:**&#x20;
    * Update the related apps to the **latest version for the best experience** (example: Gmail is 6.0.260406).
    * Chrome is the recommended default browser.
    * **Android:** If it does not work properly in the app, **clear the cache** and try again.
  * For **desktop app browser: Chrome** (or Chromium core browser) is the recommended default browser.
* These features **work reliably in web browsers**. On the mobile app, availability depends on the app version and Google's support, so usage may vary by version and is not always consistent.

### IV. Supported services, applications, and data types when using Google CSE

<table data-full-width="true"><thead><tr><th width="186.61328125">Service</th><th>Apps</th><th>Data that's client-side encrypted</th><th>Data that's not client-side encrypted</th></tr></thead><tbody><tr><td><strong>Google Drive and Google Docs Editors</strong></td><td><ul><li>Web browser</li><li>Drive for Desktop (non-Google file formats only)</li><li>Android mobile app</li><li>iOS mobile app</li></ul><p><strong>Note:</strong> </p><ul><li>For mobile apps, client-side encrypted content is view-only and available for non-Google file formats only.</li><li>For Android only, viewing files in <strong>.xlsx</strong> format is not supported.</li><li><strong>For mobile app:</strong> Chrome is the recommended default browser.</li></ul></td><td><ul><li>Files created with Google Docs Editors (documents, spreadsheets, presentations)</li><li>Uploaded files, like PDFs and Microsoft Office files</li></ul></td><td><ul><li>File title</li><li>File metadata, such as owner, creator, and last-modified time</li><li><a href="https://support.google.com/a/answer/9292382">Drive labels (also called Drive metadata)</a></li><li>Linked content that's outside of Docs or Drive (for example, a YouTube video linked from a Google document)</li><li>User preferences, such as Docs header styles</li></ul></td></tr></tbody></table>