Google just officially graduated one of its more quietly powerful enterprise features out of beta. As of May 4, 2026, bulk migrations using client-side encryption (CSE) are now generally available in Google Workspace – meaning organizations can finally move large volumes of sensitive files into Google Drive without ever handing the keys to Google.

For those unfamiliar, client-side encryption is a feature where your data gets encrypted right in the browser, before it ever reaches Google’s servers. That means even Google itself can’t read your files – only your organization holds the encryption keys through an external key management service. It’s a big deal for industries like healthcare, legal, finance, and defense where regulatory compliance isn’t optional.

What’s new here isn’t CSE itself – it’s the ability to do this at scale. Previously, organizations could use CSE for individual files, but migrating thousands of files from legacy on-premises systems or other cloud platforms while keeping them encrypted end-to-end was a major pain point. That bulk import capability was in beta since 2023, and it’s now fully production-ready.

The way it works is that files get wrapped with customer-managed encryption keys before they’re even imported into Workspace. The Drive API handles the heavy lifting, and Google has published sample code on GitHub and PyPI to make deployment more straightforward – though admins can customize the pipeline to fit their own setup. The API also supports resumable uploads for large files, which means a network hiccup won’t force you to restart an entire migration from scratch.

There’s also a smart duplicate-prevention mechanism baked in – admins can pre-generate file IDs before uploading, so if a migration crashes halfway through, the tool can pick up right where it left off without creating a mess of duplicate files in Drive.

This feature is live right now for both Rapid Release and Scheduled Release domains. It’s available for Enterprise Plus, Education Standard and Plus, and Frontline Plus tiers – so it’s squarely aimed at large organizations and institutions managing sensitive data at scale. There’s no end-user toggle in Drive; it’s purely an admin and developer-level tool called through the Drive API.

The timing also lines up with Google’s broader push on enterprise data migration – just weeks ago, Google separately announced the general availability of its new “data import” tool for migrating emails, calendars, and contacts at no extra cost. Together, these moves signal that Google is serious about making Workspace the destination of choice for organizations looking to leave legacy platforms behind – securely.