Gemini in Google Workspace
Safe
Google says Workspace customer data, including prompts, is not used to train generative models outside your domain without permission, and Gemini does not share that content outside the organization without permission. Admins set how long prompts and responses are kept, from 90 days to indefinite. For health data, Google's August 31, 2026 HIPAA included-functionality list names Gemini in Workspace and the Gemini app, and it excludes Gemini in Chrome. Coverage still depends on your Workspace edition and a signed addendum.
Last checked 2026-11-10
Data-safety checklist
Trains on your data by default
No
The Workspace generative AI privacy hub says Google does not use customer data to train or fine-tune the generative models behind the Workspace generative AI services without the customer's prior permission or instruction.How to opt out
Steps
Training on customer data is off unless the customer gives permission. No user opt-out is required for that commitment.Data retention
What they keep
Prompts and responses in Gemini in Workspace are kept from 90 days to indefinite, as admins decide. Users can delete conversations unless an admin prohibits it.BAA / HIPAA
Yes
As of August 31, 2026, Google's HIPAA included-functionality list names Gemini in Workspace and the Gemini app, excluding Gemini in Chrome, as included functionality under the Workspace HIPAA Business Associate Addendum. Gemini Notebook is discussed on a different page.Certifications
3 listed
- ISO 42001
- FedRAMP High
- BSI C5
Enterprise and admin controls
Controls
Existing Workspace controls apply, including admin retention, DLP mentioned on the security page, and the option for some customers to confine processing to the US or EU. Client-side encryption is described as a separate control that keeps keys with the customer.Sources
3 pages