AI Chatbots & Assistants
Google Gemini
High riskGoogle's AI assistant, available as a consumer app and embedded across Gmail, Docs, and the Google Workspace suite.
Is Google Gemini safe for confidential data?
Consumer Gemini conversations may be reviewed by humans and used to improve Google's models depending on the user's activity settings, and reviewed conversations can be retained for years. Gemini for Google Workspace is a different contract: prompts and workspace content are not used to train models outside the customer's domain. The danger zone is employees signed into personal Google accounts — visually identical, contractually opposite.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
"Keep Activity" setting dependent; human review possible; reviewed samples retained up to three years.
Customer content stays in-domain; covered by the Workspace terms and DPA; admin controls.
Data handling
Training on inputs
Consumer Gemini may use conversations to improve Google services and models, subject to the user's "Keep Activity" setting (formerly Gemini Apps Activity); sampled conversations may be human-reviewed. Workspace/enterprise Gemini does not use customer content to train models outside the customer's organization.
Retention
Consumer activity is retained per the user's activity settings (18 months by default, adjustable); conversations sampled for human review can be retained separately for up to three years even after deletion. Workspace content follows the customer's Workspace retention policies.
Residency
Google Cloud infrastructure; Workspace offers data-region controls on qualifying plans.
Compliance
- SOC 2Yes
- GDPR / DPAYes
- HIPAA BAAConditional
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- Workspace admin console controls
- Data-region controls (qualifying Workspace plans)
- Workspace DPA coverage
- In-domain content boundary (Workspace)
Frequently asked questions
Does Google Gemini train on my data?
On personal accounts, conversations may be used to improve Google's models depending on the "Keep Activity" setting (formerly Gemini Apps Activity), and sampled chats may be reviewed by humans. Under Gemini for Google Workspace, customer content is not used to train models outside your domain.
Is Gemini safe for confidential client data?
Under a Workspace contract with admin controls, the contractual exposure is limited. On a personal Google account it is one of the riskier mainstream chatbots because of human review and long retention of reviewed conversations. The same browser tab can be either — which is why account-level visibility matters.
How do I stop confidential data going into personal Gemini accounts?
Network blocking can't distinguish a personal login from a Workspace login on the same domain. Prompt-level controls can: Sanitized AI detects the destination, redacts sensitive fields before submission, and gives you a usage report by tool.
Policy changelog
- Initial entry published from Google's published policies.
Sources
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Google Gemini is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
OpenAI's conversational AI assistant for writing, research, coding, and file analysis, available in consumer and enterprise tiers.
Anthropic's AI assistant for analysis, writing, and coding, available as a consumer app, Team/Enterprise plans, and an API.
Chinese AI lab offering the DeepSeek chatbot app and API on low-cost frontier models, plus open-weight model releases that can be self-hosted.
Microsoft's AI assistant, spanning the free consumer Copilot and Microsoft 365 Copilot embedded across Word, Excel, Outlook, and Teams.