Encryption and decryption requests come from your users' browsers, not from Google's servers.
When a user opens or creates an encrypted file:
- The user's browser signs in to your identity provider (IdP) and receives an authentication token.
- The browser receives an authorization token from Google for that specific file.
- The browser sends a wrap (encrypt a file's key) or unwrap (decrypt it) request directly to your CSE server with both tokens.
- Your CSE server validates both tokens and returns the result. The browser then encrypts or decrypts the file on the user's device.
Google stores only encrypted data. It issues the authorization token, but it doesn't carry user wrap and unwrap requests to your server.
The Test connection check in the Google Admin console also runs from the browser. It calls your server's /status endpoint, so its source IP is the company's network, not a Google IP address.
Restricting access by source IP
An IP allowlist works only if all users, including guests, connect through dedicated egress IP addresses that your organization owns. Shared ranges from Zero Trust and VPN providers include other organizations' users. Users with dynamic IPs lose access whenever their IP changes.
Choose where to enforce
| Topology | Source IP your server sees | Where to restrict |
|---|---|---|
| Direct to host (public IP, or passthrough/network load balancer) | The real client IP | Host or VPC firewall |
| Proxy load balancer (Google Cloud external Application Load Balancer, AWS ALB, Azure Application Gateway) | The load balancer's IPs only | The load balancer's WAF or edge policy (Cloud Armor, AWS WAF, Azure WAF) |
With a proxy load balancer, an allowlist on the host firewall either blocks the load balancer or allows everyone. Put the client allowlist on the edge policy, and limit the origin firewall to the load balancer's ranges and health-check ranges.
Close the direct-to-origin path
If the origin has a public IP, make sure only the load balancer's ranges and health-check ranges can reach it. Otherwise anyone can skip the edge policy by connecting to the origin directly. A cleaner option is to remove the origin's public IP and use a NAT gateway (for example Cloud NAT) for outbound traffic.
Guest access
If you enable guest access for CSE, external users' browsers also call your CSE server. A corporate or VPN allowlist will block them. Either add their egress IPs to the allowlist (rarely practical), or rely on token validation and the hardening steps below instead of IP restrictions.