Vendors · Questionnaire · Google

Read Google’s own answers to nine buyer questions

Gemini API and Gemini models on Google Cloud. Each answer quotes Google’s own page or feed as kept on the day shown. Each question cites the NIST text that asks it. The answers are not a score and not a verdict.

Google in the vendor record google-questionnaire.csv

Q1

Does the vendor train its models on business and API customers’ data?

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10

Not used to improve products, on paid use

When you use Paid Services, including, for example, the paid quota of the Gemini API, Google doesn't use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products

Gemini API Additional Terms of Service, kept 24 Oct 2026 · sha256 0424aabe6c15

Q2

Does the vendor train its models on free and consumer use of its products?

NIST AI 600-1, action GV-6.2-007: “… contribute to unauthorized data collection by vendors or third-parties (e.g., secondary data use) …”

NIST AI RMF 1.0, MEASURE 2.10

Used to improve products, on unpaid use outside the EEA, Switzerland and the UK

When you use Unpaid Services, including, for example, Google AI Studio and the unpaid quota on Gemini API, Google uses the content you submit to the Services and any generated responses to provide, improve, and develop Google products and services and machine learning technologies

Under “Unpaid Services”, “How Google Uses Your Data”. The same section says: “If you're in the European Economic Area, Switzerland, or the United Kingdom, the terms under "How Google uses Your Data" in "Paid Services" apply to all Services, including Google AI Studio and unpaid quota in the Gemini API, even though they are offered free of charge.” Gemini API Additional Terms of Service, kept 24 Oct 2026 · sha256 0424aabe6c15

Q3

How long does the vendor keep the data that customers send?

NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”

NIST AI RMF 1.0, MEASURE 2.10

A limited period, for abuse detection and legal disclosures, on paid use

For Paid Services, Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy to maintain the safety and security of the Services, and any required legal or regulatory disclosures.

Under “Paid Services”, “How Google Uses Your Data”. The page does not state the length of the period. Some features have their own terms; for Grounding with Google Search the page says Google will store prompts, contextual information that you may provide, and output for thirty (30) days. Gemini API Additional Terms of Service, kept 24 Oct 2026 · sha256 0424aabe6c15

Q4

Can a customer have the vendor keep none of its data?

NIST AI 600-1, action GV-6.1-004: “Draft and maintain well-defined contracts and service level agreements (SLAs) that specify content ownership, usage rights, quality standards, security requirements, and content provenance expectations for GAI systems.”

NIST AI RMF 1.0, MEASURE 2.10

Zero data retention on Google Cloud, with customer actions; not possible with some features

To achieve zero data retention, customers must take specific actions within each of these areas:

Under “Customer data retention and achieving zero data retention”. The same page says: “Zero data retention may not be possible when using some Advanced AI features.” and, for Grounding with Google Search and Google Maps, “There is no way to disable the storage of this information”. Gemini Enterprise Agent Platform and zero data retention, kept 24 Oct 2026 · sha256 dca5cdf5c2ad

Q5

Where does the vendor process and store customer data?

NIST AI 600-1, action GV-6.1-009: “Update and integrate due diligence processes for GAI acquisition and procurement vendor assessments to include intellectual property, data privacy …”

NIST AI RMF 1.0, GOVERN 6.1

On Google Cloud: at rest in the chosen location; global endpoints carry no guarantee

Data stored at rest in the customer selected location remains at rest in that location, independent of the Gemini Enterprise Agent Platform endpoint called by that customer's request.

The page adds: “Requests submitted to a global endpoint may be processed in any Google Cloud location around the world, and therefore don't provide any data residency guarantees.” Data residency, kept 26 Oct 2026 · sha256 dbd4fd892d3f

Q6

Which other companies process customer data for the vendor?

NIST AI 600-1, action GV-6.1-007: “Inventory all third-party entities with access to organizational content and establish approved GAI technology and service provider lists.”

NIST AI RMF 1.0, GOVERN 6.1; NIST AI RMF 1.0, MANAGE 3.1

A published list for Google Cloud, AI services included

Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.

Several rows name the service “All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services”. Google Cloud Platform Subprocessors, kept 26 Oct 2026 · sha256 a6ed1984ff40

Q7

Which independent audits or certifications does the vendor name?

NIST AI 600-1, Appendix A.1.3: “statement on standards for attestation engagement (SSAE) reports to help with third-party transparency and risk management for GAI systems”

NIST AI RMF 1.0, GOVERN 6.1

Not published in the pages kept

Searched: Gemini API Additional Terms of Service; Gemini Enterprise Agent Platform and zero data retention; Data residency; Google Cloud Platform Subprocessors; Generative AI on Agent Platform quotas and system limits.

Q8

Does the vendor publish a history of its service incidents?

NIST AI 600-1, action GV-6.2-007: “Service Level Agreements (SLAs) in vendor contracts that address incident response, response times, and availability of critical support.”

NIST AI RMF 1.0, GOVERN 6.2

Yes: a status history feed, with 1 incident kept since 2026-02-27

Status history feed, kept 1 Nov 2026 · sha256 5e979a2555c2. The record.

Q9

Does the vendor publish the dates on which it retires its models?

NIST AI 600-1, action GV-6.2-007: “Review vendor contracts and avoid arbitrary or capricious termination of critical GAI technologies or vendor services …”

NIST AI RMF 1.0, GOVERN 6.2

Yes: Google’s Gemini API (“Gemini deprecations”) and Google’s Vertex AI (“Model versions and lifecycle”), with 94 dated retirements kept

Google’s Gemini API, “Gemini deprecations”, kept 26 Oct 2026 · sha256 e067aa760faf; Google’s Vertex AI, “Model versions and lifecycle”, kept 26 Oct 2026 · sha256 6cf2d171db3c. The record.

Sources

google-questionnaire.csv Every dataset → Status → Glossary →