Pick the edition that carries the controls you need, set the data location, turn on audit logs, and confirm that connectors respect source permissions before regulated data reaches the assistant.
When you need this
- Security asks where Gemini Enterprise keeps data and whether Google trains on it.
- Customers or regulators require data at rest in the US, the EU or one country.
- A healthcare or public sector team needs HIPAA or FedRAMP coverage before launch.
Evaluation criteria
Edition controls
Does the edition include the controls your policy requires?
Look forStandard and Plus add customer-managed encryption keys, VPC Service Controls and Cloud audit logging. Business has none of these.
Data location
Where does data rest?
Look forChoose the us or eu multi-region or a listed in-country region for data at rest when rules require it; Google recommends the global location otherwise.
Compliance
Is Gemini Enterprise in scope for the programs you need?
Look forGoogle lists Gemini Enterprise on its HIPAA, FedRAMP, ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2 and SOC 3 pages; confirm the scope for your edition.
Audit logs
Are admin and data access recorded?
Look forTurn on Data Access audit logs in Cloud Logging for Standard and Plus projects.
Questions to ask vendors
- Which edition do our regulated teams need?
- Which location did we pick for data at rest, and does it match our contracts?
- Who reviews Gemini Enterprise audit logs?
- Which connectors index content with broader access than intended?
Red flags
- Regulated data on Business seats.
- The global location for data that must stay in the EU.
- Data Access audit logs left off.
- Overshared source folders connected without cleanup.
Products in this piece
Sources
- Official documentation
- 5