Google Gemini Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Google Gemini

1. 1

   **[Priority 1 — Privacy & Data Governance]** Obtain and review Google Gemini's current AI data usage policy, specifically seeking written commitments on: whether customer data is used to train models, data retention periods, and opt-out availability. Start at https://policies.google.com or request documentation from your Google account representative. Document the response before granting the platform access to sensitive enterprise data.

2. 2

   **[Priority 2 — Supply Chain Transparency]** Request a subprocessor list covering Google Gemini's data processing infrastructure. Begin with Google Workspace's published list at https://workspace.google.com/intl/en/terms/subprocessors.html and confirm with your Google contact whether it applies to Gemini. If your organization is subject to GDPR, ensure a Data Processing Agreement (DPA) is in place.

   GDPR Full TextDPA Template (GDPR Art. 28)
3. 3

   **[Priority 3 — Privacy Controls Validation]** Review and configure available privacy controls before enterprise rollout — specifically, audit whether Google Photos access, message/call access, and other Personal Intelligence features are enabled by default in your deployment. Google's Admin Console (for Workspace customers) should allow feature-level controls; confirm with your account team which Gemini features are active.

4. 4

   **[Priority 4 — Security Header Monitoring]** Note the C-grade HTTP security header finding and raise it with your Google account team. Review the specific could not be completed tests at https://observatory.mozilla.org/analyze/gemini.google.com and request a response or timeline. Reassess the header configuration in 90 days.

5. 5

   **[Priority 5 — Certification Verification]** Request Google Gemini's current SOC 2 Type II report from your Google account or security contact — ask specifically for the report covering Gemini's infrastructure. Also check Google's trust center for any published compliance documentation. SOC 2 reports are confidential and have no public registry, so direct vendor engagement is the only verification path.

   SOC 2 Overview (AICPA)

• No firmographic data (headcount, company type, industry classification) was available for gemini.google.com as a subdomain entity — the platform is a product of Alphabet Inc./Google LLC and does not appear separately in company databases.
• No subprocessor page was found for gemini.google.com specifically; disclosures may exist within broader Google or Google Workspace privacy documentation but were not independently located during this assessment.
• The Hacker News post alleging unauthorized data usage ('I caught Google Gemini using my data and then covering it up') could not be independently corroborated through this assessment's evidence sources; the severity and accuracy of the underlying claim is unverified.
• No AI data usage policy source was returned for this assessment, limiting independent analysis of training data commitments, retention periods, and opt-out mechanisms specific to Google Gemini.
• No certification registry verification data was returned for this assessment; SOC 2, ISO 27001, and other compliance certification statuses for Google Gemini could not be independently confirmed or denied. Note: SOC 2 reports are confidential and no public registry exists — buyers should request the report directly from Google's security team.
• The infrastructure scanner 'self-signed' infrastructure tag could not be fully contextualized; for large CDN infrastructure, this tag may reflect internal service-to-service certificates rather than client-facing TLS misconfiguration.
• External cyber risk scoring was not available for this vendor during the assessment period, which may limit the completeness of the overall risk posture evaluation.