Data encryption

This section describes the different layers of encryption in storage. Google Distributed Cloud (GDC) air-gapped appliance

Encryption at rest

There are different layers of data at rest encryption that GDC air-gapped appliance provides.

Encryption in transit

Data in transit is encrypted using IPsec on two types of OTS traffic:

External traffic between bare metal hosts and OTS Storage Virtual Machines (SVMs).
Internal traffic between OTS worker nodes.

The IPsec on both traffic is implemented by the third party library strongSwan (https://strongswan.org/). The OTS internal traffic is built with the OpenVSwitch vxlan tunnel and it also uses strongSwan to encrypt the data flow under the layer.

Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-08-11 UTC.

Data encryption Stay organized with collections Save and categorize content based on your preferences.

Encryption at rest

Encryption in transit

Data encryption