This document has been a long-time coming, and finally lets us talk about the encryption we perform on your behalf when transiting outside our physical boundaries. There are lots of paths, but I think the diagram [1] captures it well.

Edit: Of particular note is that if you have a VM in say us-central1 talking to another of your VMs in us-east1, we encrypt that traffic across regions (even though it's riding our backbone).

Disclosure: I work on Google Cloud (and even sort of contributed to this).

[1] https://cloud.google.com/images/security/whitepaper-transit-...