> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/user-guide/publish-your-docs/google-gmail.md).

# Google Gmail

### **I. Sending an Encrypted Email**

* **Initiation**: The sender composes a new email and explicitly turns on Additional encryption.
* **Verification**: The user is required to sign in to verify their account before the message is sent.
* **Encryption**: Google generates a Data Encryption Key (DEK), which is used to encrypt the email body, inline images, and attachments.
* **Key Wrapping (KMS Interaction):** Google sends the DEK to your organization's external Key Management System (KMS) or Key Access Control List Service (KACLS). The KMS uses its master key to wrap (re-encrypt) the DEK.
* **Transmission**: The encrypted message, along with the wrapped DEK, is transmitted and stored on Google's servers.

### **II. Receiving an Encrypted Email**

* **Notification**: The recipient receives the mail, which is marked with a blue shield icon and shows an "Encrypted message" notification.
* **Authentication**: The receiver opens the email and must sign in to their identity provider to verify their account.
* **Key Unwrapping**: The KMS verifies the user's access rights and uses the master key to unwrap (decrypt) the DEK.
* **Decryption**: The client receives the unencrypted DEK and uses it to automatically decrypt the email content, which is then displayed in the Gmail browser window.

### III. Showcase

{% embed url="<https://app.supademo.com/demo/cmnpx87pu03iuye0jpr0j622l?utm_source=link>" %}

***

### I. Maximize feature potential

* To optimize the use of this features across browsers and mobile apps, please configure your settings as follows:
  * For **mobile app:**&#x20;
    * Update the related apps to the **latest version for the best experience** (example: Gmail is 6.0.260406).
    * Chrome is the recommended default browser.
    * **Android:** If it does not work properly in the app, **clear the cache** and try again.
  * For **desktop app browser: Chrome** (or Chromium core browser) is the recommended default browser.
* These features **work reliably in web browsers**. On the mobile app, availability depends on the app version and Google's support, so usage may vary by version and is not always consistent.

### IV. Supported data types when using Google CSE for Wrap/Unwrap Gmail

<table data-full-width="true"><thead><tr><th width="186.61328125">Service</th><th>Apps</th><th>Data that's client-side encrypted</th><th>Data that's not client-side encrypted</th></tr></thead><tbody><tr><td><strong>Gmail</strong></td><td><ul><li>Web browser</li><li>Android mobile app</li><li>iOS mobile app</li></ul><p><strong>Note:</strong></p><ul><li><strong>For mobile app:</strong> Chrome is the recommended default browser.</li></ul></td><td><ul><li>Email body, including inline images</li><li><p>Attached files</p><p><strong>Note</strong>: Attaching client-side encrypted Drive files isn't yet supported</p></li></ul></td><td>Email header, including Subject:, timestamps, and recipients lists</td></tr></tbody></table>