Google Workspace Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for Google Workspace

1. 1

   Request the current SOC 2 Type II report and a bridge letter — contact your Google Workspace account representative or visit the [Google Compliance Reports Manager](https://workspace.google.com/security) where audit reports are available for download under NDA.

   SOC 2 Overview (AICPA)
2. 2

   If your organization uses Gemini in Workspace or other AI features, review the [AI and data usage terms](https://workspace.google.com/terms/service-terms/) with your legal/privacy team to confirm alignment with your AI governance policy, particularly regarding training commitments and data retention for AI-processed content.

3. 3

   For healthcare customers: verify whether a HIPAA Business Associate Agreement is in place by checking [workspace.google.com/terms/2015/1/hipaa_baa/](https://workspace.google.com/terms/2015/1/hipaa_baa/) and executing the BAA before storing any PHI in Google Workspace.

   HIPAA Overview (HHS)HIPAA BAA Guidance
4. 4

   For EU-regulated customers: confirm that the [Data Processing Agreement](https://workspace.google.com/terms/09242021/dpa_terms/) is executed and that data residency has been configured to the EU region via the Admin Console under Account > Data regions.

   DPA Template (GDPR Art. 28)
5. 5

   Set a calendar reminder to verify TLS certificate renewal for workspace.google.com by May 22, 2026 (30 days before the June 22 expiry). If your organization manages custom domains under Workspace, check those certificates separately in the Admin Console.

   SSL Labs Test
6. 6

   Review the published [subprocessor list](https://workspace.google.com/terms/subprocessors/) periodically — Google is contractually required to notify customers of subprocessor changes, so ensure your team is subscribed to update notifications via the Workspace Admin Console or Google's notification mechanism.

   GDPR Subprocessor Rules

• Certificate Transparency log data (Certificate Transparency service) was unavailable during this assessment; certificate details were extracted from a direct TLS handshake only and full subdomain enumeration was not performed.
• The Web archive service archive reported workspace.google.com as first seen in February 2026, which conflicts with the WHOIS record showing google.com registered in 1997. This discrepancy reflects the subdomain's recent prominent indexing rather than the underlying domain's age and should not be interpreted as a new web presence.
• ISO 27001 certification status was returned as 'not_found' in the IAF CertSearch registry query. Google has publicly documented ISO/IEC 27001:2022 certification for Workspace, but independent registry confirmation was not obtained during this assessment cycle — compliance teams should request the current certificate directly.
• HITRUST certification was not found in the HITRUST certified entity directory. This is noted for healthcare-sector buyers who may require HITRUST CSF certification as a contractual requirement.
• The AI data usage policy at the vendor's service terms page does not explicitly state a training commitment, retention period, or opt-out mechanism for Gemini in Workspace features. The policy scope covers user prompts and generated output but key AI governance fields could not be automatically extracted.
• PCI DSS compliance level could not be independently confirmed via the PCI Security Standards Council registry during this assessment. Google acknowledges PCI DSS compliance in documentation, but the specific certification level was not verifiable from available evidence.
• Ai data|policy|governance coverage was limited for this assessment. This does not confirm any deficiency — direct verification with the vendor is recommended.