Product and intended use
Define the configuration, people, information and tasks being assessed.
Plan
Public claim only
Gemini Notebook Enterprise (formerly NotebookLM Enterprise) runs in a Google Cloud project with VPC-SC, CMEK and data residency. Consumer Gemini Notebook (notebooklm.google / personal Google Account) is a different product: public sharing, no specified residency. Workspace Gemini Notebook for business is a third SKU. This profile is the Enterprise Cloud product.
Ask: Confirm we would deploy Gemini Notebook Enterprise in our Cloud project, not consumer NotebookLM.
Deployment
Public claim only
Enterprise: data stays in the customer's Google Cloud project; region-specific URL; Cloud Identity or SAML/OIDC IdP. Uploaded sources become a static copy in that project under Google Cloud terms.
Ask: Which region will the project use, and is CMEK on?
Features
Public claim only
Grounded Q&A over uploaded sources with citations to quotes. Audio/video overviews, mind maps, reports. Enterprise adds DOCX/PPTX/XLSX. Not a live DMS and not a case-law citator unless those files are uploaded.
Ask: Will we upload privileged PDFs into a Cloud project copy, and who can share notebooks inside the project?
Australia
Public claim only
Enterprise residency follows Gemini Enterprise location commitments (documented separately). Consumer has none. AU region availability must be read from the locations page.
Ask: Is an Australian processing location available for Gemini Notebook Enterprise?
Data, controls and requirements
Compare the actual configuration with firm, client and jurisdiction requirements, supported by evidence.
Sharing
Public claim only
Enterprise notebooks cannot be shared publicly; only within the Cloud project. Consumer notebooks can be shared publicly — do not use consumer.
Ask: Confirm public sharing is impossible on our Enterprise project.
Model provider
Public claim only
Gemini models. Enterprise is Google Cloud.
Ask: Any non-Google model in Audio Overview or related features?
Subprocessors
Not confirmed
Google Cloud subprocessors. Confirm Audio Overview vendors.
Ask: Subprocessor list for Notebook Enterprise including audio generation.
Training
Public claim only
Workspace Privacy Hub: prompts are customer data under the Cloud DPA; Workspace does not use customer data to train generative AI models without prior permission (Training Restriction in Workspace Service Specific Terms). Independent auditors cited (SOC, ISO 42001). Consumer NotebookLM is not covered by that Workspace commitment.
Ask: Confirm the Cloud DPA Training Restriction applies to Gemini Notebook Enterprise in our project.
Feedback
Public claim only
Workspace hub: feedback improves products per Cloud Privacy Notice but is not used to train the generative models supporting Workspace Gemini services. Admin controls exist.
Ask: Disable optional feedback if we do not want prompts in the improvement channel.
Retention
Not confirmed
Static copies of sources live in the Cloud project until deleted. Default TTL not on the overview page.
Ask: Retention of notebooks, source copies, queries and audio overviews?
Deletion
Not confirmed
Project-level deletion should follow Cloud DPA. Confirm notebook-level delete of embeddings.
Ask: Certified deletion of source copies and derived indexes?
Vendor access
Public claim only
Workspace hub: content is not human reviewed for model training outside the domain without permission. Support access follows Cloud practices.
Ask: When can Google staff read notebook content?
Access
Public claim only
Cloud Identity or SAML/OIDC. IAM roles for share within project. VPC-SC supported. No public share.
Ask: SSO-only and project IAM least privilege demo.
Encryption
Public claim only
CMEK documented as a compliance feature for Notebook Enterprise.
Ask: Enable CMEK on the project before uploading matter PDFs.
Assurance
Public claim only
Gemini: SOC 1/2/3, ISO 27001/27701/27017/27018/42001, FedRAMP High (Gemini). Confirm Notebook Enterprise is in those scopes.
Ask: Scope statements covering Gemini Notebook Enterprise.
Contract
Public claim only
Google Cloud Terms + Cloud DPA for Enterprise uploads. Consumer Terms if anyone uses notebooklm.google with a personal account.
Ask: Execute Cloud DPA; block consumer NotebookLM.
Transfers
Public claim only
Residency is a Cloud location choice. Consumer has none.
Ask: APP 8 map for the chosen region versus any global audio feature.
Incidents
Not confirmed
Cloud incident process.
Ask: Notice timeline for a notebook-content breach?
Changes
Public claim only
Product renamed toward Gemini Notebook. Feature set expanding.
Ask: Notice before Audio Overview or sharing defaults change?
Exit
Not confirmed
Export notebooks then delete project data under Cloud DPA.
Ask: Export format for sources, chats and audio?
Connectors
Public claim only
Drive, Docs, Slides, public URLs, YouTube. Public URL/YouTube sources are an open-web disclosure if used on a matter notebook.
Ask: Disable public URL and YouTube sources on matter notebooks.
Web search
Public claim only
Public URLs can be added as sources. That is opt-in web ingest, not a licensed citator.
Ask: Keep public URL ingest off for privileged notebooks.
Actions
Not confirmed
Generates audio/video overviews and reports. Sharing inside the project exposes sources to the recipient.
Ask: Who may generate Audio Overviews, and can we disable that feature?
Oversight
Public claim only
Citations to quotes support checking. No forced review gate.
Ask: Audit who queried which notebook?