https://www.theregister.co.uk/2019/11/20/google_cloud_next/

Google is taking new steps to ensure the volumes of data it stores for businesses are properly protected.

The ad-slinging network is introducing new security features to its cloud platform, including "Key Access Justification," now in alpha, which lets customers approve or deny every request for the key that decrypts their data. This can be combined with an External Key Manager feature that lets you store the keys in a third-party key management system outside Google's infrastructure.