Product and intended use
Define the configuration, people, information and tasks being assessed.
Which components this covers, and the two outside the assurance scope
Public claim only
Google's Privacy Hub (read 2026-09-27) states the hub covers 'Gemini in Workspace - including apps like Gmail, Docs, Drive, and Meet', the 'Gemini app - Including gemini.google.com, Gemini in mobile apps, and Gemini in Chrome' and 'Gemini Notebook (formerly known as NotebookLM)', and applies only when used with a qualifying Workspace edition. The same page states that Gemini Notebook 'does not support ISO, SOC, or FedRAMP compliance and is not covered by the Google Business Associate Agreement (BAA) for HIPAA compliance', and says the same of Gemini in Chrome. This profile is a different plan tier from Gemini Enterprise for Legal, which the catalogue holds separately under the id 'gemini'.
Ask: Which Gemini components are enabled for our users, and are Gemini Notebook and Gemini in Chrome turned off given they sit outside the ISO, SOC and FedRAMP scope?
Inside the Workspace tenancy, no direct internet path
Public claim only
The Privacy Hub answers 'Does using Gemini in Workspace involve direct internet access?' with 'No. When users interact with Gemini in Workspace, their queries remain within the Google internal environment. The service does not establish a direct connection between the user's local network and the public internet. Instead, all processing occurs within Google's secure infrastructure, maintaining the same enterprise-grade protections as other Google Workspace core services.' Administrators can enable or disable Gemini features per service in Gmail, Drive, Docs, Meet and Chat, and can disable the Gemini app as a core service, which is on by default.
Ask: Which Workspace services will have Gemini enabled, and is the Gemini app left on by default for all users?
What the vendor publishes as the capability set
Public claim only
From Google's own en_AU pages (read 2026-09-27): the Gemini app for chat; Gemini Notebook, 'an AI research assistant, included in Google Workspace plans, that is grounded in the documents that you provide', producing summaries, Audio Overviews, Mind Maps and Video Overviews; Gemini in Gmail to summarise threads, find details and draft emails; Gemini in Docs to 'Create fully formatted first drafts in moments'; Gemini in Meet for AI note-taking and translated captions; Gemini in Sheets and Slides; Drive described as 'Transform your storage into an active knowledge base to quickly find, summarise and synthesise insights across all of your files'; and Google Workspace Studio to 'Create AI-powered workflows across Workspace apps'. The Privacy Hub adds Workspace Intelligence as the retrieval engine over Gmail, Drive, Calendar and Chat.
Ask: Which of these features are available on our edition, and can Workspace Intelligence be restricted to particular services?
No Australian data region; United States or Europe only
Public claim only
Google's admin page 'Data covered by data regions' (last updated 24 September 2026, read 2026-09-27) states 'With data regions, you can choose to store your covered data in a specific geographic location (the United States or Europe). Data regions cover data at rest (including backups) and data processing for customer-supplied data in several Google Workspace core services.' The covered-data table lists 'Gemini App - Prompts and responses' and 'Google Workspace with Gemini - Prompts and responses' as covered both at rest and during processing, with processing coverage varying by edition. It also states data regions 'cannot be applied to customer-supplied data or data types not specifically stated in this document, such as logs or cached content'. Australia is not among the choices. Section 10.1 of the Cloud DPA permits processing 'in any country where Google or its Subprocessors maintain facilities', subject to data-location commitments in the Service Specific Terms.
Ask: Given that Australia is not a data region, would our Gemini prompts and responses be pinned to Europe or the United States, and which edition gives processing coverage as well as storage coverage?
Sold as productivity AI, cross-selling a different product for agents
Public claim only
The en_AU pages present Gemini as AI assistance built into Workspace plans for writing, summarising, meeting support and workflow building. The same AI solutions page cross-sells Gemini Enterprise, a different product that the catalogue holds separately; its claims must not be read onto this one. The Privacy Hub also states that 'Personal Intelligence' is a beta feature for eligible personal Google accounts and is not available for Workspace Business, Enterprise or Education accounts.
Ask: Are we being quoted Gemini included in Workspace, or Gemini Enterprise, and which of the two does each claimed capability belong to?
Check for vendor content directing how AI describes the product
Public claim only
Checked deliberately on 2026-09-27. No content addressed to AI models, assistants or LLMs telling them how to describe this product was found. https://workspace.google.com/llms.txt returned 404 after redirect, /ai-info and /ai.txt returned 404, and https://www.google.com/llms.txt returned 404; https://cloud.google.com/llms.txt returns HTTP 200 but serves an HTML page rather than an llms.txt file. https://workspace.google.com/robots.txt returned 200, 284 bytes, with a single 'User-agent: *' group and no AI-crawler allow or disallow directives. Neither scraped en_AU page carries a block addressed to AI models.
Ask: Does Google publish any machine-readable file or guidance telling AI assistants how to describe Gemini in Workspace?
Vendor answering a comparative question about itself in its own Q&A
Public claim only
Google's Privacy Hub (read 2026-09-27) answers the question 'Does using Gemini impact any existing compliance certifications (e.g. ISO, SOC, etc.)?' by listing certifications and then stating: 'With these certifications, Gemini has one of the most comprehensive set of safety, privacy and security certifications internationally recognized by regulatory and compliance bodies.' The same answer continues: 'No other generative AI offering for productivity and collaboration has met this level of recognition, showing that Gemini is the first in the industry ready to support businesses and public sector organizations while benefiting all users.' The earlier 'Model training and data usage' answer contains the related claim that Google has attained 'some of the most comprehensive set of safety, privacy and security certifications and attestations for Gemini'. These are the vendor's own comparative claims about itself in its own published question-and-answer material, recorded as such and not adopted; no comparison set is published alongside them.
Ask: Which products were compared, and against which criteria, to support the statement that no other generative AI offering for productivity and collaboration has met this level of recognition?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
What Gemini can reach is what the user can reach
Public claim only
Google states that 'Gemini only retrieves relevant content in Workspace that the user has access to', that 'Your interactions with Gemini stay within your organization' and that Gemini 'does not share your content outside your organization without your permission'. The Privacy Hub adds that prompt content 'is not used beyond the context of the user trust boundary' and that conversations are visible only to the individual user, even in shared files. Because the corpus is the firm's own Gmail and Drive, client material is in scope by default unless restricted by DLP, IRM or client-side encryption.
Ask: Do we need client authority before Gemini may read client emails and matter documents in Gmail and Drive, and which repositories will be excluded?
Google's own models only, version not disclosed
Public claim only
The Privacy Hub answers 'What models does Gemini use?' with 'Gemini uses a collection of models from Google's rich repository', pointing to a blog post rather than naming versions. No third-party model provider appears on any page read. Nothing states whether a customer can select or pin a model version, so customer model choice is recorded as unknown rather than denied.
Ask: Which Gemini model versions serve Workspace features for our tenancy, can a version be pinned, and how are we told when it changes?
Published list named in the addendum, with objection right
Public claim only
Appendix 4 of the Cloud Data Processing Addendum (read 2026-09-27) states that names, locations and activities of Google Workspace and Cloud Identity sub-processors are described at workspace.google.com/intl/en/terms/subprocessors.html. Section 11.4 provides that when Google engages a new sub-processor it will notify the customer at least 30 days before that sub-processor starts processing Customer Data, and the customer may object within 90 days by terminating the agreement for convenience. Section 11.3 requires a written contract limiting the sub-processor's access and imposing the addendum's data-protection obligations, with Google remaining fully liable. The list itself was not read within the credit cap.
Ask: Which sub-processors on the Workspace list touch Gemini prompts and responses, and in which countries do they process them?
No training without permission, resting on the Service Specific Terms
Public claim only
The Privacy Hub answers 'Does Google use my data (including prompts) to train generative AI models?' with 'No. User prompts are considered customer data under the Cloud Data Processing Addendum. Workspace does not use customer data for training models without customer's prior permission or instruction. This commitment is outlined in the Training Restriction section of the Google Workspace Service Specific Terms.' It repeats the commitment 'not to use customer data to train or fine-tune any of Google's generative artificial intelligence models supporting the Google Workspace Generative AI Services without our customer's prior permission or instruction', and the en_AU page states data 'is not used to train or improve Gemini models or for ads targeting'. The Service Specific Terms that would make this contractual were not read within the credit cap.
Ask: Point us to the Training Restriction clause in the Google Workspace Service Specific Terms, and confirm no permission or instruction has been given for our tenancy.
Voluntary feedback, not used for model training, kept up to 18 months
Public claim only
The Privacy Hub states that providing in-product feedback 'is entirely voluntary' and that if a user submits it they may share a rating, a pre-defined issue category, free text and - 'only if the checkboxes to share the prompt and output remain selected by the user' - the prompt, the contextual sources such as documents or email messages, and the generated output. It states feedback 'is used to improve generative AI products and services in accordance with the Google Cloud Privacy Notice, but it is not used to train any of the generative AI models that support Google Workspace Generative AI Services', for aggregate analysis, bug fixing and safety improvement, and that 'Feedback data may be retained for up to 18 months.'
Ask: Can the option to attach prompts and source documents to feedback be disabled for our users, and who at Google can read a submitted prompt?
Retention set by administrators, indefinite by default option
Public claim only
Google's published retention table (Privacy Hub, last updated 14 August 2026, read 2026-09-27) gives, for Gemini in Workspace prompts and responses, '90 days to indefinite, as determined by admins', with users able to delete conversations unless prohibited by administrators; for the Gemini app, 'Up to 36 months, as determined by admins', and the text adds that when conversation history is off new chats are saved for up to 72 hours, and when on, administrators may choose auto-deletion after 3, 18 or 36 months with a default of 18 months; for Gemini Notebook, prompts and responses are 'Not retained after session ends'. Inserted or generated content follows Section 6 of the Cloud DPA and can be managed with Vault.
Ask: What retention period is set on our tenancy for Gemini in Workspace and Gemini app conversations, and is user deletion allowed?
Contractual deletion within 180 days
Public claim only
Section 6.1 of the Cloud Data Processing Addendum (read 2026-09-27) provides that using the Services to delete Customer Data in a way that cannot be recovered constitutes an instruction to delete it from Google's systems, which Google will comply with 'as soon as reasonably practicable and within a maximum period of 180 days', subject to legal storage requirements. Section 6.2 provides that at the end of the Term the customer instructs Google to delete all remaining Customer Data including existing copies, and that 'After a recovery period of up to 30 days from that date' Google will comply within a maximum of 180 days. Section 6.3 defers that instruction where the same data is processed under a continuing Term.
Ask: Does the 180-day deletion commitment cover Gemini conversation histories and any cached or log data, given data regions do not apply to logs or cached content?
Access limited to instruction; no human review of content for training
Public claim only
Section 7.1.2 of the Cloud DPA binds Google to 'authorize its employees, contractors and Subprocessors to access Customer Data only as strictly necessary to comply with Instructions' and to ensure all persons authorised to process Customer Data are under an obligation of confidentiality; Appendix 2 adds that Google 'employs a centralized access management system to control personnel access to production servers, and only provides access to a limited number of authorized personnel' with unique user IDs, two-factor authentication and logged access, and that 'Google's personnel will not process Customer Data without authorization'. The Privacy Hub states 'Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission', and that client-side encryption content cannot be accessed by any Google system or employee.
Ask: Under what circumstances would a Google person read a Gemini prompt or response from our tenancy, and would that access be visible to us?
Existing Workspace permissions and restriction controls
Public claim only
The Privacy Hub states that 'The strict data access control model for Gemini does not allow for inputs or session content to leak across user boundaries', that Gemini retrieves only content the user can access, and that Information Rights Management and client-side encryption can restrict Gemini's access to sensitive data - for example, 'if a user isn't allowed to download, print, or copy files based on the IRM policy, Gemini will not retrieve those files or their content on the user's behalf'. It adds that generated output inserted into Gmail or Drive is evaluated against in-scope DLP policies. Section 7.1.1 of the Cloud DPA lists these as Additional Security Controls the customer may use at its option.
Ask: Which classification labels and IRM policies would be applied to exclude privileged material from Gemini retrieval, and who maintains them?
Encryption in the addendum plus optional client-side encryption
Public claim only
Section 7.1.1 of the Cloud DPA commits Google to security measures that 'include measures to encrypt Customer Data', and Appendix 2 states Google makes HTTPS encryption available and allows for encryption of data in transit. Google may update the Security Measures provided the update does not materially reduce the security of the Services. Separately, the Privacy Hub states client-side encryption can restrict Gemini's access 'because no Google system or Google employee have the technical means to access CSE content'.
Ask: If we enable client-side encryption on privileged matter folders, which Gemini features stop working on that content?
Certifications claimed for Gemini, with two components excluded
Public claim only
The Privacy Hub states Gemini has attained SOC 1, 2 and 3, ISO 9001, ISO/IEC 27001, 27701, 27017, 27018 and 42001 certifications and FedRAMP High authorisation, and can support HIPAA workloads with the HIPAA Included Functionality updated to cover Gemini. It also states that Gemini Notebook and Gemini in Chrome each 'does not support ISO, SOC, or FedRAMP compliance' and is not covered by the Business Associate Agreement. Contractually, Section 7.4 of the Cloud DPA requires Google to maintain at least an ISO 27001 certificate plus additional certifications in Appendix 4, and SOC 2 and SOC 3 reports updated annually, for the Audited Services; Appendix 4 adds ISO 27017 and 27018 for Workspace. Certificate numbers and audited scope are not on the pages read.
Ask: Provide the current SOC 2 report and ISO 27001 and 42001 certificates showing Gemini in Workspace inside the audited scope, and confirm which components are excluded.
Governing documents named; contracting entity not established
Public claim only
The Privacy Hub answers 'What is the scope of agreements that govern the use of generative AI?' by naming the Cloud Data Processing Addendum, the Workspace Services Summary, the Service Specific Terms and the Generative AI Prohibited Use Policy. The Cloud DPA itself (read 2026-09-27) states it 'is incorporated into the Agreement(s) ... between Google and Customer' and that it was formerly the Data Processing Amendment for Google Workspace, but it does not name a Google contracting entity, and the Workspace terms page was not read within the credit cap. So the entity an Australian firm would contract with, and any ABN or ACN, are not established.
Ask: Which Google legal entity would contract with us for Workspace in Australia, what is its ABN or ACN, and what law governs that agreement?
Processing anywhere Google or its sub-processors operate
Public claim only
Section 10.1 of the Cloud DPA states that, subject to Google's data location commitments under the Service Specific Terms and transfer commitments under Appendix 3 where applicable, 'Customer Data may be processed in any country where Google or its Subprocessors maintain facilities'. Because data regions offer only the United States or Europe, no Australian confinement is available, and data regions expressly do not extend to logs or cached content. The en_AU page names 'Digital sovereignty - Apply residency, encryption and vendor controls to limit the location and access to your data' as an Enterprise-tier feature without naming any country.
Ask: What written data-location commitment can Google give for Gemini prompts and responses, and does it cover logs and cached content?
Prompt notification obligation in the addendum
Public claim only
Section 7.2.1 of the Cloud DPA provides that Google 'will notify Customer promptly and without undue delay after becoming aware of a Data Incident, and promptly take reasonable steps to minimize harm and secure Customer Data'. Section 7.2.2 sets out what the notification must describe: the nature of the incident including the customer resources impacted, measures taken or planned, measures recommended to the customer, and a contact point, with further information to follow as it becomes available. Section 7.2.3 states Google has no obligation to assess Customer Data to identify information subject to specific legal requirements, and Section 7.2.4 that notification is not an acknowledgement of fault. No fixed hour count is given.
Ask: What does Google treat as 'promptly and without undue delay' in practice for a Data Incident, and how would notification reach our nominated contact?
Security measures and certifications may change; sub-processor notice is fixed
Public claim only
Section 7.1.1 of the Cloud DPA lets Google update the Security Measures from time to time 'provided that such updates do not result in a material reduction of the security of the Services', and Section 7.4 provides that 'Google may add standards at any time' and 'may replace a Compliance Certification or SOC Report with an equivalent or enhanced alternative'. New sub-processors carry at least 30 days' notice under Section 11.4 with a 90-day objection window. On the product side, the Privacy Hub carries a 'Last updated' date and an Updates section, and Google invites subscription to notice of material changes to its AI data policy.
Ask: How will we be told when a Gemini model version, retention default or certification scope changes, and does any of that trigger a right to object?
Export and return before deletion
Public claim only
Section 6.2 of the Cloud DPA provides that a customer wishing to retain Customer Data after the Term 'may instruct Google in accordance with Section 9.1 (Access; Rectification; Restricted Processing; Portability) to return that data during the Term', after which the deletion instruction and the 30-day recovery period apply. On the product side, Google states that Gemini Notebook uploaded files and notebooks can be exported using Google Takeout, and that Vault can manage retention and export for supported Workspace services and data types.
Ask: On exit, can Gemini conversation histories and Notebook contents be exported, in what format, and are they inside Vault's supported data types?
Retrieval across the customer's own apps, admin-controlled
Public claim only
The Privacy Hub describes Workspace Intelligence as the engine that 'finds and retrieves content across your active Workspace apps (Gmail, Drive, Calendar, and Chat) to give Gemini the deep context needed', and states administrators 'can enable or disable specific Workspace services (Gmail, Drive, Calendar, or Chat) from being actively searched by Gemini'. It notes that even where a source is globally disabled, 'users can still securely ask Gemini about a specific file they explicitly link in their prompt, or use Gemini to analyze a document they currently have open'. No third-party document-management connector is published on the pages read.
Ask: Which Workspace services will be left searchable by Gemini, and are we content that a globally disabled source can still be reached by an explicit link?
Grounding against Google's internal web index
Public claim only
The Privacy Hub answers how Gemini retrieves real-time information with: 'Gemini uses an internal Search grounding mechanism to provide up-to-date information. Rather than crawling the live web directly from your organization's environment, Gemini performs lookups against Google's internal web index. This allows the model to access relevant, real-time data while ensuring that your prompts and data remain protected within the Google Workspace security boundary.' Nothing on the pages read states whether Search grounding can be turned off, what part of a prompt is used to form the lookup, or whether sources are cited to the user.
Ask: Can Search grounding be disabled for our tenancy, what portion of a prompt forms the lookup against Google's index, and are sources shown to the user?
Workflow building and threat checks before an action
Public claim only
The en_AU page presents Google Workspace Studio for creating 'AI-powered workflows across Workspace apps'. The Privacy Hub states that 'When users prompt Gemini to perform an action in Gemini in Workspace or the Gemini app, Gemini checks for threats before performing the action. If Gemini identifies malicious content or detects suspicious activity, it notifies the user and excludes the content, or blocks the action', linking to material on prompt-injection mitigation. No published list of the actions Gemini or a Studio flow may take without human approval was found on the pages read.
Ask: Which actions can a Workspace Studio flow take without a human approval step - sending email, sharing files, editing documents - and how are they logged?
No human review in the product; Google puts fitness on the customer
Not confirmed
Nothing on the pages read describes a human-review or approval step inside the product before Gemini output reaches a user or is inserted into a document. Google's own en_AU legal page places the duty on the firm: 'Legal teams must use AI responsibly, making sure that they act ethically without breaching lawyer-client privilege.' Section 7.3.2 of the Cloud DPA has the customer agree that the Services and security measures provide a level of security appropriate to the risk, and Section 7.3.1 makes the customer responsible for its use of the Services.
Ask: Who inside the firm checks Gemini-generated drafts, meeting notes and summaries before they are relied on or sent, and how is that check evidenced?
