#Data Encryption Methods

Data encryption can be divided into two scenarios: data transmission (data in transit) encryption and data storage (data at rest) encryption.

For data transmission encryption, Cloud Backup for Google Workspace is deployed on the Microsoft Azure / Google Cloud Platform framework to make outbound Google API calls and internal communications over HTTPS/TLS encrypted channels. Certificate-based authentication is used for internal communications.

For data storage encryption, Cloud Backup for Google Workspace encrypts all the Google Workspace data obtained by calling Google APIs with AES 256 using keys unique to each tenant (either default keys or BYOK). The encryption happens before the data is transmitted to storage.

When transmitting the encrypted data to storage, the data transmission encryption will leverage their own data transmission encryption algorithm or protocols applied of the target storage’s available protocols.