Encryption: Google default encryption, Cloud KMS customer-managed keys and customer-supplied keys

All data stored in Google Cloud is encrypted at rest by default, with no action on your part. Google uses envelope encryption: data is encrypted with data encryption keys, which are themselves encrypted with key encryption keys held in Google's internal key management systems. Data in transit between Google data centers and to Google services is also encrypted. For many workloads, this default encryption with Google-owned and Google-managed keys is enough.