Skip to main content
Within Google Cloud Key Management Service (KMS), there are several different sub-offerings, and Google Cloud External Key Manager (EKM) is one of them. With Google Cloud EKM, you can use keys that you manage within a supported external key management partner (such as the VirtuCrypt Enterprise Key Management service) to protect data within Google Cloud. You can protect data at rest in Google BigQuery or Compute Engine persistent storage services or by calling the Cloud Key Management Service API directly.

​
Key benefits

The Google Cloud EKM VirtuCrypt integration provides the following benefits:
  • Key provenance: You control the location and distribution of your externally-managed keys. Externally managed keys are never cached or stored within Google Cloud. Instead, Cloud EKM communicates directly with VirtuCrypt for each request.
  • Access control: You manage access to your externally-managed keys. Before you can use an externally managed key to encrypt or decrypt data in Google Cloud, you must grant the Google Cloud project access to use the key. You can revoke this access at any time.
  • Centralized key management: You can manage your keys and access policies from a single location and user interface, whether the data they protect resides in the cloud or on your premises.
In all cases, the key resides in VirtuCrypt and is never sent to Google.