Learn about Meet Client-side Encryption (CSE)

To protect your information, Meet always encrypts call media in transit and at rest. Call media can only be decrypted by the meeting participants and Google's data center services for Meet.

Client-side encryption adds an additional encryption layer for privacy and only shares that session key with:

• meeting participants
• the key service of the meeting host organization (as CSE is used with an IdP/key service infrastructure)

With CSE, all media is encrypted by each participant's browser using keys only made available to the participants. Only the meeting participants can decrypt the call media while it remains unreadable to Google's servers or any other service provider.

To use CSE, your admin must connect Google Workspace to an external identity provider and encryption key service (IdP+key service). Learn how admins manage CSE for your organization.

Learn about CSE requirements in a video meeting

Learn how CSE works in meetings

You can join a CSE meeting the same way you join a non-CSE meeting. For CSE meetings, participants can’t join until the host or a co-host assigned by the organizer has joined. Participants that join before the host get a black screen with the words “waiting for the host to join”.

Learn about unavailable functions in CSE meetings

Learn how to invite a participant to a CSE meeting

If your admin configures CSE for external access, you can invite external participants regardless of whether they use Google Workspace or not. Your CSE call's level of privacy with external participants remains as high as it would be with only internal participants, and session keys are never shared with Google. Learn how admins manage CSE for external access.

Due to authentication requirements, participants must be invited to join a meeting. Participants can no longer knock to join a meeting.

A participant can enter a CSE meeting if the host sends an invitation:

• Through a calendar event. Learn how to invite people to your Calendar event.
• During a video meeting. Learn how to send an invitation through an email.
  • Only invited participants can access the meeting through the meeting code or link.

Create an encrypted event in Google Calendar

Important: You can only add CSE when you create an event.

1. On your Android device, open the Google Calendar app .
2. Tap Create Event .
3. Tap Add encryption Add encryption.
   • You may get a pop-up to authenticate with your IdP.
   • Tip: Always turn on CSE before you enter any event details. When you turn on CSE, event descriptions and unencrypted attachments are reset.
4. Add event details like:
   • Titles
   • Guests
   • Descriptions
   • Attachments
     • You can only select encrypted attachments. Get started with encrypted files in Drive, Docs, Sheets & Slides.
   • Video conferences
     • Google Meet may have limited functions with CSE. Learn about Meet Client-side encryption
     • You must join the encrypted video call from your own device, not a meeting room device.
     • You can’t use add-on video conferencing, like Zoom.
5. Tap Save.

Find out if CSE is turned on for a meeting

Important: Only hosts can add CSE to their meetings.

So you know when CSE is on, a shield appears.

Before the meeting, the shield appears:

• Next to the “Join with Google Meet” button in a Google Calendar invite.
• Next to the meeting on your agenda at meet.google.com or in the Meet app .

During the meeting, the shield appears at the top left hand corner of the meeting window.