Decide where processing may happen, then pick the endpoint that enforces it. Set zero data retention on purpose, because it needs two opt-outs, and confirm which security controls and compliance programs cover the models and features you use.
When you need this
- Customers or regulators require processing in the US or the EU.
- Security asks whether prompts are logged, cached or used for training.
- A healthcare, public sector or financial workload needs a compliance program in scope before launch.
Evaluation criteria
Endpoint and residency
Which endpoint keeps processing where your rules require?
Look forThe global endpoint can serve from any region with capacity. The us and eu multi-region endpoints keep processing inside that boundary, and named regional endpoints keep it in one region. A healthcare IT engineer on Hacker News runs Claude through Vertex because the company's healthcare customers already accept Google as a vendor.
Zero data retention
Have you opted out of abuse-monitoring prompt logging and caching?
Look forGoogle does not train on customer data without permission. Zero data retention also requires opting out of prompt logging for abuse monitoring and disabling caching.
Security controls per feature
Do CMEK, VPC Service Controls and Access Transparency cover each feature you use?
Look forThe security controls matrix lists data residency at rest, CMEK, VPC Service Controls and Access Transparency per feature. Check each model and feature you use against it before regulated data reaches the platform.
Audit and compliance
Are the logs and compliance programs you need in place?
Look forAdmin Activity audit logs are always written, and Data Access audit logs can be enabled. Google Cloud's services-in-scope table lists Agent Platform under its compliance programs, including ISO 27001 and SOC 2. A defense contractor on Hacker News reports Vertex AI inside a FedRAMP High assured workload, and not for ITAR.
Questions to ask vendors
- Which endpoint does each service call today, and does it match our residency commitments?
- Who confirmed the abuse-monitoring opt-out, and when?
- Which features we use sit outside VPC Service Controls or CMEK?
- Which compliance program does our largest customer require, and is Agent Platform in its scope?
Red flags
- Calling the global endpoint for data that must stay in the EU.
- Assuming zero data retention is on by default.
- Regulated data sent to a feature the security controls matrix does not cover.
- Data Access audit logs left off for a regulated workload.
Products in this piece
Sources
- Official documentation
- 5
- Public source
- 2
- Agent Platform documentation: Deployment and endpoint locations
- Agent Platform documentation: Agent Platform and zero data retention
- Agent Platform documentation: Security controls
- Google Cloud: Agent Platform audit logging
- Google Cloud: Services in scope for compliance programs
- Hacker News comment on running Claude through Vertex for healthcare customers (Jul 21, 2026)
- Hacker News comment on Vertex AI inside a FedRAMP High assured workload (Mar 27, 2026)