Is GAE Datastore encrypted?

Question

I'm using Objectify to store entities into the datastore for my App Engine Project. I need the data to be encrypted... Is this something that happens automatically, or will I need to implement the encryption/decryption at the points in my code where I read/write the entity?

I've looked through the GAE documentation, but the only reference I could find to encryption was for Cloud Storage (buckets.) I couldn't find any mention of encryption with Cloud Datastore.

what do you mean by encrypted btw? store some fields encrypted? or whole entity? and what is your goal, hide original content from viewing in google cloud console? also, do you understand that encrypted fields cannot be indexed and used query filters? — Igor Artamonov
My end goal is to fulfil a requirement that sensitive data can not be obtained by someone who gets a 'dump' of the database without accessing it in a way supported by Google. For example, the files in the Cloud Storage are encrypted, but if you view them through the Google Cloud Console, the contents are not encrypted... so I suppose the console does the decryption as you read the file and are logged in as someone authorised to read the file. — Mat DeLong
Ideally, I'd like the whole entity encrypted and maintain the ability to use indexes on columns. If Google handles the encryption internally then I see no reason why this wouldn't be possible using some hashing strategy before encryption. — Mat DeLong
I don't believe it is. This isn't even an AppEngine or datastore question. Datastore is based on Bigtable, so the actual question is: Does Google encrypt their Bigtables? And again: I don't believe they do, because Bigtables' primary focus is on performance not security. I've never thought of it but does any database actually encrypt data? You could create colums with encrypted values but encryption and columns are two opposite concepts imho. — konqi
@MatDeLong if google handles encryption internally (that could be true) you'll get unencrypted data anyway, including dumps and google console. or how do you plan to operate this data other way? so, don't see how internal encryption could help with your goal — Igor Artamonov

Patrick Costello Patrick Costello · Accepted Answer · 2015-06-16T23:58:08

You can see information about Google Cloud Platform's security features on the security page. That page has a section on Data Encryption. You should also check out the compliance page since it does meet a lot of different compliance standards.

As mentioned in some of the comments, you should always handle your own encryption to protect sensitive data (i.e. credit card numbers), since it can still be accessed through legitimate channels. Otherwise someone who has access to your application (like an owner with code upload privileges -- or someone who has gotten access to an owner's computer) could still get that data.

Update: We now also have a white paper talking about Encryption at Rest on the Google Cloud Platform

Is GAE Datastore encrypted?

1 Answers