It is encrypted by the key service and not by google: https://support.google.com/a/answer/10801691

can be self hosted.