Cloud Storage always encrypts your data on the server side, before it is
written to disk, at no additional charge. This page discusses the standard
encryption that Cloud Storage performs. For other encryption options,
see [Data Encryption Options](https://docs.cloud.google.com/storage/docs/encryption.md.txt).

Cloud Storage manages server-side encryption keys on your behalf using
the same hardened key management systems that we use for our own encrypted data,
including strict key access controls and auditing. Cloud Storage
encrypts user data at rest using [AES-256](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard), in most cases using
[Galois/Counter Mode (GCM)](http://wikipedia.org/wiki/Galois/Counter_Mode). There is no setup or
configuration required, no need to modify the way you access the service, and
no visible performance impact. Data is automatically decrypted when read by an
authorized user.

For more information about how Google Cloud and Cloud Storage manage
encryption keys, see [Default encryption at rest](https://docs.cloud.google.com/docs/security/encryption/default-encryption.md.txt).

To protect your data as it travels over the Internet during read and write
operations, use Transport Layer Security, commonly known as TLS or HTTPS.

## What's next

- Learn more about [Choosing an encryption option](https://docs.cloud.google.com/storage/docs/encryption.md.txt).

- For more information about how Google-owned and Google-managed encryption keys are rotated, managed,
  and stored, see [Key management](https://docs.cloud.google.com/docs/security/encryption/default-encryption.md.txt#key_management).

- See [Encryption at the storage system layer](https://docs.cloud.google.com/docs/security/encryption/default-encryption.md.txt#hardware) to learn about the
  encryption modes that are used in Google Cloud.

- [Configure which encryption methods are allowed or restricted](https://docs.cloud.google.com/storage/docs/encryption/enforce-encryption-types.md.txt) for new
  objects in your buckets.