I have an App running at GCP App Engine wich stores data in a Cloud SQL PostgreSQL.
Since this App is aimed to be used by various diferent clients, I need a way to guaratee to them that they are the only ones that have access to their respective data, even when I am the one who manages the cloud services on GCP.
The only way I foud that this could be achived is by means of client side enchryption (please correct me if I am wrong).

I couldn’t find information about achieve this goal with keys been stored locally, only with keys been stored in Cloud KMS (Can this solve the problem?). Here it was just mentioned in the overview.