How secure is Google Drive?

Google Drive is without a doubt one of the best-known cloud services on the market. Although the cloud storage provider makes backups and storing data par­tic­u­lar­ly easy, you may be asking yourself if Google Drive is secure enough to host your data.

Data you upload to Google Drive is secured by the AES 256-bit en­cryp­tion standard during uploads, downloads and when stored on the server. Google also uses two-factor au­then­ti­ca­tion, geo­re­dun­dant data centers, and perfect forward secrecy for secure SSL en­cryp­tion. Despite all of these measures, Google is an American company and under the Cloud Act, they are obliged to send data to the U.S. gov­ern­ment if required by a court order.

What is Google Drive?

Drive is Google’s cloud service and an integral part of every Google account. Google Drive offers 15 GB of free cloud storage and ad­di­tion­al storage space can be upgraded to over 2 TB for an ad­di­tion­al fee. In addition, users have access to multiple Google Workspace ap­pli­ca­tions such as Docs, Meet, Sheets or Calendar. The business version of Google Drive as well as the Google One sub­scrip­tion offer even more practical teamwork ex­ten­sions.

How is Google Drive encrypted?

Modern AES 256-bit en­cryp­tion is used for data uploaded and down­loaded to Google Drive and for storing data on Google’s servers. AES en­cryp­tion (Advanced En­cryp­tion Standard) is one of the most common, secure and widely used en­cryp­tion standards. The U.S. gov­ern­ment also encrypts their files by using AES. The number 256 stands for the en­cryp­tion length, which can generate up to 115 duodecil­lion different keys. For this reason, AES keys are extremely difficult to crack, even with brute force attacks.

Fur­ther­more, Google Drive uses the reliable en­cryp­tion standard SSL/TLS to protect com­mu­ni­ca­tion between browsers and servers. This standard confirms the iden­ti­ties of the client and server, and makes sure that the con­nec­tion between both parties is secure. By using this standard, Google ensures optimal Google Drive data privacy during data transfer.

What access rights does Google Drive offer?

The basic Google Drive rule is that only you can access your data. However, to enable col­lab­o­ra­tion with other people, Google Drive allows you to share files with other users by granting them access to selected documents and files.

You have a number of different sharing settings and options to choose from. For example, you can specify whether access should be con­fi­den­tial, meaning that a person can only access the files when logged into their Google account. Or, al­ter­na­tive­ly, you can grant access via a shareable link or choose to grant public access without re­stric­tion. Publicly ac­ces­si­ble files can be used by up to 100 devices at the same time.

To share files, select a file and enter the email address of the person you want to share the file with via the Share and Invite people commands. In order to access the files, the person must have an account. A Google account can be created in a few steps.

As stated pre­vi­ous­ly, Google Drive is an American company, which means the U.S. gov­ern­ment tech­ni­cal­ly also has access to data stored in Google Drive via the Cloud Act.

How does the Cloud Act affect Google Drive?

Enacted in 2018, the Cloud Act defines the access rights of U.S. au­thor­i­ties to stored data. The act requires all U.S. companies to grant U.S. au­thor­i­ties access to users’ data, even if it’s not stored in the United States. If ordered by a court, Google must allow the U.S. au­thor­i­ties to access the requested data. Under certain con­di­tions, access is even possible without a court order.

It’s also important for companies doing business in the EU to note, that under the EU’s strict GDPR, or data security laws, data trans­ferred from the EU to the U.S. is currently (as of January 2023) not seen as secure. The EU-U.S. Privacy Shield, which had pre­vi­ous­ly been used to regulate the secure transfer of data from the EU to the U.S., was declared invalid by the European Court of Justice in 2020. The increased data sur­veil­lance measures by the U.S. gov­ern­ment, namely the Cloud Act and the Foreign In­tel­li­gence Sur­veil­lance Act (FISA), were behind the reason for the EU’s decision.

As a result, U.S. companies storing any data from EU citizens must ensure that data is stored according to the European data pro­tec­tion standards for data sov­er­eign­ty in cloud computing.

How secure is Google Drive against cy­ber­at­tacks?

Although Google Drive isn’t safe enough to be used for storing most business-critical data, it still offers its users solid cloud access security and pro­tec­tion against cy­ber­at­tacks.

Below are the most notable data pro­tec­tion methods Google Drive offers:

• Password pro­tec­tion, in com­bi­na­tion with a secure password
• Two-factor au­then­ti­ca­tion
• AES 256-bit en­cryp­tion
• TLS en­cryp­tion
• Geo­re­dun­dan­cy for secure data centers
• Account recovery through a security question, email con­fir­ma­tion or via phone
• Warnings about sus­pi­cious logins
• Reliable spam filter
• Backup & sync to protect against data loss
• Automatic malware scans of emails and files
• En­cryp­tion of uploads and downloads
• Perfect forward secrecy to prevent sub­se­quent de­cryp­tion of data

If you have a paid sub­scrip­tion to Google Workspace, you can access even more security measures. These include a cloud-first and zero-trust approach, as well as special data pro­tec­tion measures for teams, such as defined security groups and ad­min­is­tra­tor rights.

Where are Google Drive servers located?

Google’s servers are primarily located in the USA. However, the Cloud Act also applies to data stored on Google servers in other countries. The U.S. gov­ern­ment has the right to request data located outside of the U.S. if granted by the court.

What are the Google Drive’s data privacy standards?

In addition to the afore­men­tioned en­cryp­tion standards, Google Drive has obtained data security cer­ti­fi­ca­tion ISA 27001 (SOC1, SOC2, SOC3) as well as cer­ti­fi­ca­tions from the American Institute of Certified Public Ac­coun­tants (AICPA). This means that Google’s servers are regularly audited by in­de­pen­dent bodies. Access to data is also re­strict­ed to a select group of people that carry out data main­te­nance and security.

Nev­er­the­less, there are a few gray areas when it comes to privacy and Google Drive. Google states in its privacy policy and terms of use that they reserve the right to au­to­mat­i­cal­ly scan uploaded data based on in­for­ma­tion such as keywords and images. Google says they do this to detect, remove and report malware and illegal content. Google also produces regular reports and analyses about cloud use as well as system crashes to improve the user ex­pe­ri­ence. For customer support issues, data may also be shared with partner companies. This makes it difficult to say how your data is ul­ti­mate­ly processed by Google.

Is Google Drive secure for companies?

Google Drive offers fairly secure data pro­tec­tion methods and tools. However, since Google doesn’t offer zero-knowledge en­cryp­tion, the company can access your data and give it to the U.S. gov­ern­ment if they are obligated to. There are Google Drive al­ter­na­tives on the market that encrypt stored data so that the service providers can’t access the data even if they are asked to. So, if that is what you are looking for, Google Drive is not a secure enough option.

However, it’s com­plete­ly okay to use Google Drive for storing non-critical data. You just need to put adequate data security measures in place yourself and make sure your company adheres to them.

Creating secure passwords that are changed at regular intervals and setting up two-factor au­then­ti­ca­tion are important practices with all cloud storage providers. These measures allow providers to double check who the data is shared with both inside and outside the company. This is even more important when using Google Drive, because the access rights system is not very granular. For example, it’s hard to structure data so that only certain de­part­ments or groups have access to certain files or folders. There is also a high risk of human error when typing email addresses to provide access to data. Ad­di­tion­al pre­cau­tions should also be taken when linking other ap­pli­ca­tions to you Google Drive. It’s best not to give any other ap­pli­ca­tions access to Google Drive as these can offer hackers more ways to access your Google Drive data.

Although it might be a tedious task, read carefully through Google’s data privacy and con­trac­tu­al clauses. This way you will be aware of document risks as­so­ci­at­ed with data storage and transfer and will be prepared if something happens.

Using Google Drive in a trans­par­ent way

If your company is using Google Drive to store any customer data, you should com­mu­ni­cate this to your customers in a trans­par­ent way. If your company is offering its services in the EU, they also need to be aware of the GDPR reg­u­la­tions, which have an impact on how your company should use Google Drive.

Below we’ve listed the most important points to follow when col­lect­ing or storing any data from EU citizens. However, in order to operate in a trans­par­ent manner, we recommend you follow them for your U.S. customers as well:

• Allow the user to opt in or refuse essential and non-essential cookies.
• Create an order pro­cess­ing contract with Google to clarify the following questions:
  • What personal data is passed on to Google?
  • Why is the data being passed on?
  • How long will data be stored by Google?
  • What rights and oblig­a­tions are Google and the company subject to?
• Customize your privacy policy regarding Google Drive use and data pro­cess­ing by providing answers to the following questions:
  • Why is Google Drive used to store data?
  • What is the legal basis for data storage and data sharing?
  • How can users object to the col­lec­tion and storage of data?
  • Where can users find data pro­tec­tion reg­u­la­tions and Google’s terms of use?

What are some al­ter­na­tives to Google Drive?

If you still have doubts about how secure Google Drive is and are wondering which cloud is the most secure, you should conduct a cloud storage com­par­i­son to find the best provider. A com­par­i­son will give you the op­por­tu­ni­ty to evaluate different cloud service providers based on the range of services and security measures offered. If you are looking for a cloud service provider with a robust data pro­tec­tion policy, European cloud providers such as the Swiss pCloud or the German cloud provider IONOS, with its secure HiDrive cloud storage, are good options.