In a move to bolster data security for organizations in highly regulated industries, Google has introduced Cloud Hardware Security Module (Cloud HSM) for Google Workspace (CHGWS). The offering brings Google Cloud’s most rigorous compliance standards to Workspace customers, particularly those leveraging Client-Side Encryption (CSE).
CSE, already available across Workspace services like Gmail, Drive, Meet, and Calendar, gives enterprises an additional layer of protection by allowing them to manage their own encryption keys. This ensures that sensitive information — whether financial records, healthcare data, or intellectual property — remains confidential and under the customer’s control.
The new Cloud HSM service enhances that protection by offering a fully managed, hardware-backed key management solution. Operated at cloud scale, Cloud HSM uses FIPS 140-2 Level 3 compliant Marvell LiquidSecurity HSMs (models CNL3560-NFBE-2.0-G and CNL3560-NFBE-3.0-G with firmware versions 3.4 build 09). These cryptographic modules have undergone rigorous validation, meeting some of the highest security benchmarks in the industry.
For regulated sectors such as government, defense, finance, and healthcare, the move is particularly significant. The service supports compliance obligations including ITAR, EAR, FedRAMP High, DISA IL5, SOC 1/2/3, and PCI DSS, among others. By enabling organizations to retain encryption keys within defined geographic or national boundaries, Cloud HSM also provides demonstrable data sovereignty.
Currently available in the U.S. and expanding globally in the coming months, Cloud HSM for Google Workspace comes with a flat, predictable pricing model, aiming to make deployment and management straightforward for enterprises.
With this launch, Google strengthens its pitch to security-conscious organizations that need both flexibility and compliance assurance in managing sensitive workloads at cloud scale.
