← All platforms
GGoogle Cloud KMS
The cleanest of the three cloud services, with the most serious answer for keys you refuse to hand over.
Cloud KMSEncryption keysBy GoogleSince 2017
- Type
- Cloud KMS
- How it works
- Key rings and key versions with explicit rotation, offered in software, HSM and external tiers. External Key Manager is the differentiator: the key stays in your own system and Google calls out to it, so the cloud can be denied access by design rather than by policy.
- Scope
- Encryption keys
- Deployment
- SaaS (GCP)
- Hardware / key custody
- HSM tier FIPS 140-2 Level 3; External Key Manager for off-cloud keys
- Pricing*
- Metered per key version + operations · pricing page
- Free tier
- No
- Licence
- —
- Best for
- GCP workloads and hold-your-own-key rules
- Notable
- External Key Manager (true HYOK)
* Published list pricing at August 2026 (vendor pricing pages, August 2026), not a quote.
Strengths
- Clear key ring and version model
- External Key Manager is a genuine sovereignty answer
- Consistent API across software and HSM tiers
- Strong Confidential Computing story alongside
Trade-offs
- No free tier
- External keys add latency and a hard dependency
- Keys only — secrets are a separate service
- GCP-shaped
Visit Google Cloud KMS → Documentation
Listed for comparison as of August 2026 — not an endorsement, and Google Cloud KMS did not pay for placement. See disclosure.
Compare Google Cloud KMS with…