View logs and reports for client-side encryption

You can view the following Google Workspace Client-side encryption (CSE) logs for administrator activity and reports. 

Audit log

For details on viewing the history of changes to your organization's CSE settings, go to Admin log events .

Encrypted files upload and download reports

For details on viewing client-side encryption reports, go to Client-side encryption and decryption reports .

Encrypted files investigation report

Use the security investigation tool to get a report on Google Drive or Google Calendar activity for encryption. For details, go to:

• Drive log events
• Calendar log events

For the condition's Attributeoptions, select Encrypted,  Is, and  True.

Or, if you've made CSE the default for Drive or Calendar, and want to monitor when users turn off CSE:

For the condition's Attributeoptions, select Encrypted,  Is, and  False.