Vertex AI
google.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- No formal subprocessor register disclosed
- Data retention window not stated
- Underlying model providers not named
+1 more
See Before you sign, with what to ask for ↓
Scanned Sep 1, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance — governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The vendor names AI-related providers or partially addresses its supply chain, but the public sources scanned do not include a formal, dated subprocessor register.
What to ask for: Request a dated subprocessor register with change-notification terms for the DPA/order form.
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
“Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time in the following scenarios and conditions. To achieve zero data retention, customers must take specific actions within each of these areas:”
“6.1 Deletion by Customer . Google will enable Customer to delete Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an Instruction to”
Why it matters: AI is used but the public sources scanned do not name which foundation models or providers sit in the request path.
What to ask for: Require named providers and model versions, plus notice before any model change.
Why it matters: The public sources scanned do not state where customer data is processed or offer a residency option.
What to ask for: Pin processing regions per data classification in the contract.
Buyer questionsanswered only from the public evidence scanned — click a row for the answer
✓Will they train on your data?Clear
Google states it will not use customer data to train or fine-tune AI/ML models without prior permission or instruction, covering all managed models on the platform including pre-GA models.
“Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform, including GA and pre-GA models.”
!How long do they keep your data?Ask the vendor
Customer data is retained for limited periods in defined scenarios, and achieving zero data retention requires the customer to take specific actions in each of those areas rather than it being the default.
Requires written confirmation — see Before you sign ↓
“Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time in the following scenarios and conditions. To achieve zero data retention, customers must take specific actions within each of these areas:”
“6.1 Deletion by Customer . Google will enable Customer to delete Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an Instruction to”
!Who else can access your data?Ask the vendor
Google publishes a Google Cloud Platform subprocessor register giving the relevant service and applicable cloud region for each subprocessor.
Requires written confirmation — see Before you sign ↓
“The GCP Subprocessors tables show the following information for each Subprocessor: Relevant GCP service Applicable Cloud region”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
!Where is your data processed?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
!What happens in a security incident?Ask the vendor
The Cloud Data Processing Addendum defines a Data Incident as a breach of Google's security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Data on Google-controlled systems.
Confirm in writing: Ask the vendor to state this in writing before signing.
““ Data Incident ” means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Google.”
Email to send the vendor7 items to confirm in writing
Hello Google team, We are assessing Vertex AI (Google) as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 2. How long do you retain our data, in days, for each type (inputs, outputs, logs and backups), and how is it deleted? 3. In which countries and regions is our data processed and stored, and can processing be limited to a region we choose? 4. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 5. Please provide the ISO/IEC 42001 certificate and confirm whether Gemini Enterprise Agent Platform sits within its scope. 6. Google appears to be involved as a model provider: confirm whether this dependency exists, and whether it processes customer data. 7. Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data. A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
Key findingsclick a row for the evidence
✓ISO/IEC 42001 is listed — the AI management system standard itselfStrong
Google Cloud lists ISO/IEC 42001 within its compliance offerings alongside the ISO/IEC 27001 family and SOC 1/2/3. IRAP is listed for Asia Pacific.
42001 is the standard written for AI management systems, and almost no vendor in this directory holds it. Its presence is the single most relevant certification signal for an AI platform — but this is a catalogue listing, not a certificate, so the scope question (whether it names this platform) is exactly what a buyer must resolve before relying on it.
Question for vendor: Please provide the ISO/IEC 42001 certificate and confirm whether Gemini Enterprise Agent Platform sits within its scope.
“ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3”
“IRAP (Information Security Registered Assessors Program) | JIIMA | K-ISMS (Korea) | MTCS (Singapore) Tier 3”
✓A no-training commitment that reaches pre-GA modelsStrong
Google commits not to use customer data to train or fine-tune AI/ML models without prior permission, and states this covers all managed models on the platform including those not yet generally available.
Pre-release models are where training carve-outs normally live, so extending the restriction to them is substantive rather than boilerplate. It is vendor-published documentation, so it belongs in the contract rather than being relied on from a docs page.
“Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform, including GA and pre-GA models.”
!Zero data retention is configured, not grantedGap
Customer data is retained for limited periods in defined scenarios, and the documentation states that achieving zero data retention requires the customer to act in each of those areas.
Buyers routinely read "zero data retention" as a property of the platform. Here it is an outcome the customer must configure and request, so an organisation assuming it by default would be wrong about where its prompts are held.
Question for vendor: What is the current retention and abuse-logging state for our projects, and has an abuse-monitoring exception been granted?
“Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time in the following scenarios and conditions. To achieve zero data retention, customers must take specific actions within each of these areas:”
✓The contract carries the incident, deletion and subprocessor definitionsStrong
The Cloud DPA defines a Data Incident, sets deletion on customer instruction, defines what a Subprocessor is and how data subject requests are handled, and makes Compliance Certifications and SOC Reports contractual Security Documentation.
These are the terms most vendors leave to a trust page that can be rewritten. Having them in the addendum means they survive a marketing refresh and are enforceable, which is a materially stronger position than the same words on a website.
““ Data Incident ” means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Google.”
“6.1 Deletion by Customer . Google will enable Customer to delete Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an Instruction to”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
“a. advise the data subject to submit their request to Customer; b. promptly notify Customer; and c. not otherwise respond to that data subject’s request without authorization from Customer.”
“Security Documentation ” means the Compliance Certifications and the SOC Reports.”
!The product has been renamed by the vendorGap
Google's own Service Specific Terms refer to "Gemini Enterprise Agent Platform (formerly Vertex AI Platform)". The assessment was requested under the former name.
Contract terms already use the new name while much third-party material still says Vertex AI. Procurement paperwork naming only the old name may not match what is being bought.
“This restriction does not apply to Gemini Enterprise Agent Platform (formerly Vertex AI Platform) so long as Customer does not use a Google Pre-Trained Model.”
!No model provider or platform-specific scope is evidencedGap
The subprocessor register is Google Cloud-wide and names no third-party model provider for this platform, and no platform-specific certification scope statement or security documentation was retrievable.
Organisation-level evidence legitimately applies to the platform, but it cannot answer whether a certificate names it — and that distinction is where AI assurance usually fails. The certifications above are strong precisely to the extent their scope covers this product.
Question for vendor: Which certifications name Gemini Enterprise Agent Platform in scope, and which subprocessors serve it specifically?
“The GCP Subprocessors tables show the following information for each Subprocessor: Relevant GCP service Applicable Cloud region”
“ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3”
?Technical dependency observed: GoogleObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a model provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Google appears to be involved as a model provider: confirm whether this dependency exists, and whether it processes customer data.
“The GCP Subprocessors tables show the following information for each Subprocessor: Relevant GCP service Applicable Cloud region”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
?Technical dependency observed: MicrosoftObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“The GCP Subprocessors tables show the following information for each Subprocessor: Relevant GCP service Applicable Cloud region”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
Assurance dimensionsweighted components of one score — not eight separate ratings
Organisation & AI governance15% of the scoreorganisation-level evidence65
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Who owns AI risk — policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“a. advise the data subject to submit their request to Customer; b. promptly notify Customer; and c. not otherwise respond to that data subject’s request without authorization from Customer.”
“AI Principles Our approach to developing and harnessing the potential of AI is grounded in our founding mission — to organize the world's information and make it universally accessible and useful. We believe our approach to AI must be both bold and responsible. Bold in rapidly innovating and deploying AI in groundbreaking products used by and benefiting people everywhere, contributing to scientific advances that deepen our understanding of the world, and helping humanity address its most pressing challenges and opportunities. And responsible in developing and deploying AI that addresses both user needs and broader responsibilities, while safeguarding user safety, security, and privacy. We approach this work together, by collaborating with a broad range of partners to make breakthroughs and maximize the broad benefits of AI, while empowering others to build their own bold and responsible solutions. Our approach to AI is grounded in these three principles: 1. Bold innovation We develop AI that assists, empowers, and inspires people in almost every field of human endeavor; drives economic progress; and improves lives, enables scientific breakthroughs, and helps address humanity's biggest challenges. Developing and deploying models and applications where the likely overall benefits substantially outweigh the foreseeable risks. Advancing the frontier of AI research and innovation through rigorous application of the scientific method, rapid iteration, and open inquiry. Using AI to accelerate scientific discovery and breakthroughs in areas like biology, medicine, chemistry, physics, and mathematics. Focusing on solving real world problems, measuring the tangible outcomes of our work, and making breakthroughs broadly available, enabling humanity to achieve its most ambitious and beneficial goals. 2. Responsible development and deployment Because we understand that AI, as a still-emerging transformative technology, poses evolving complexities and risks, we pursue AI responsibly throughout the AI development and deployment lifecycle, from design to testing to deployment to iteration, learning as AI advances and uses evolve. Implementing appropriate human oversight, due diligence, and feedback mechanisms to align with user goals, social responsibility, and widely accepted principles of international law and human rights. Investing in industry-leading approaches to advance safety and security research and benchmarks, pioneering technical solutions to address risks, and sharing our learnings with the ecosystem. Employing rigorous design, testing, monitoring, and safeguards to mitigate unintended or harmful outcomes and avoid unfair bias. Promoting privacy and security, and respecting intellectual property rights. 3. Collaborative progress, together We make tools that empower others to harness AI for individual and collective benefit. Developing AI as a foundational technology capable of driving creativity, productivity, and innovation across a wide array of fields, and also as a tool that enables others to innovate boldly. Collaborating with researchers across industry and academia to make breakthroughs in AI, while engaging with governments and civil society to address challenges that can't be solved by any single stakeholder. Fostering and enabling a vibrant ecosystem that empowers others to build innovative tools and solutions and contribute to progress in the field. Other languages Our AI Principles in action Guided by our AI Principles, our AI governance is operationalized through a comprehensive and multi-layered approach that spans the entire model lifecycle—from responsible model development and deployment to post-launch monitoring and remediation. We identify and assess AI risks through research, expert input, and comprehensive pre- and post-launch testing—which inform our policies and frameworks. We implement robust mitigations to address these risks, enabling our safety measures to continuously adapt to the complexities of a rapidly advancing technological landscape. Learn more about our approach to responsible AI Learn more See past AI Progress reports 2025 2024 2023 2022 2021 2020 2019 Responsible Generative AI toolkit Learn more People + AI Guidebook Learn more Open Research on Responsible AI Learn more Google’s”
Governance & accountability: vendor-evidenced, not yet independently corroborated.
AI system15% of the score13
What AI the vendor actually runs and where it sits in the product — the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“This restriction does not apply to Gemini Enterprise Agent Platform (formerly Vertex AI Platform) so long as Customer does not use a Google Pre-Trained Model.”
How AI features are evaluated before and after release — evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
How changes to models and AI features are controlled and communicated — versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
Testing & evaluation: not publicly evidenced.
Change management: not publicly evidenced.
Model10% of the scoreorganisation-level evidence0
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
Model provider transparency: not publicly evidenced.
Customer data15% of the score85
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform, including GA and pre-GA models.”
“Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time in the following scenarios and conditions. To achieve zero data retention, customers must take specific actions within each of these areas:”
“6.1 Deletion by Customer . Google will enable Customer to delete Customer Data during the Term in a manner consistent with the functionality of the Services. If Customer uses the Services to delete any Customer Data during the Term and that Customer Data cannot be recovered by Customer, this use will constitute an Instruction to”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the scoreorganisation-level evidence40
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“The GCP Subprocessors tables show the following information for each Subprocessor: Relevant GCP service Applicable Cloud region”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
Security foundation15% of the scoreorganisation-level evidence65
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
How security problems are found, reported and handled — disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
““ Data Incident ” means a breach of Google’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data on systems managed by or otherwise controlled by Google.”
Independent assurance evidence10% of the scoreorganisation-level evidence85
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Whether claimed certifications and attestations are independently corroborated — checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3”
“IRAP (Information Security Registered Assessors Program) | JIIMA | K-ISMS (Korea) | MTCS (Singapore) Tier 3”
“Security Documentation ” means the Compliance Certifications and the SOC Reports.”
Document held and reviewed by TrustyCyber — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Document held and reviewed by TrustyCyber — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
Capped at 85: none of the corroborated certifications is AI-specific — this is security attestation, not AI-management-system assurance.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score60
The contractual backbone a buyer can rely on — terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“This restriction does not apply to Gemini Enterprise Agent Platform (formerly Vertex AI Platform) so long as Customer does not use a Google Pre-Trained Model.”
“Security Documentation ” means the Compliance Certifications and the SOC Reports.”
““ Subprocessor ” means a third party authorized as another processor under this Addendum to process Customer Data in order to provide parts of the Services”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent — not applicable to this scan.
What would strengthen assuranceeach figure is from today's score — resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 59 → up to 79 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split — that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 10 — registry checks and verification ladders, click to view
Listed in Google Cloud's compliance offerings catalogue. No certificate or scope statement was available, so coverage of this platform is unestablished.
Not yet checked against a registry — a verification task is queued with TrustyCyber.
Certificate 2012-001b, EY CertifyPoint; certified since 11 May 2012, re-issued 12 January 2026, expires 14 May 2027. The scope is the Google Cloud ISMS and is limited to Enterprise Customers, so it does not cover Google as a whole - consumer services sit outside it. Named in-scope offerings include Gemini Enterprise (including Agentspace), Gemini for Google Cloud, Gemini Code Assist and the Vertex AI platform services.
Checked against ISO/IEC 27001:2022 certificate 2012-001b (EY CertifyPoint) held in the TrustyCyber vault, obtained from Google's Compliance Reports Manager, Sep 1, 2026: Verified on the registry
Certificate 2016-004b, EY CertifyPoint, expires 14 May 2027, against the Statement of Applicability dated 8 October 2025. The scope list names Generative AI on Vertex AI, so the assessed product is covered. ISO/IEC 27017 is the cloud-services code of practice, which makes it the shared-responsibility counterpart to the 27001 certificate rather than a substitute for it.
Checked against ISO/IEC 27017:2015 certificate 2016-004b (EY CertifyPoint) held in the TrustyCyber vault, obtained from Google's Compliance Reports Manager, Sep 1, 2026: Verified on the registry
Certificate 2016-005b, EY CertifyPoint; re-issued 12 January 2026, expires 14 May 2027. The named in-scope services are Gemini Code Assist, Gemini Enterprise (including Agentspace), Gemini for Google Cloud, Gemini in BigQuery, Generative AI on Vertex AI and the Vertex AI Platform - cloud services, not the organisation.
Checked against ISO/IEC 27018:2019 certificate 2016-005b (EY CertifyPoint) held in the TrustyCyber vault, obtained from Google's Compliance Reports Manager, Sep 1, 2026: Verified on the registry
Not yet checked against a registry — a verification task is queued with TrustyCyber.
SOC 2 Type 2, Ernst & Young LLP, Google Cloud Platform System, period 1 May 2025 to 30 April 2026, unqualified opinion. Trust services criteria are security, availability, confidentiality and privacy - processing integrity is not in scope. The system described is Google Cloud Platform, not Google as an organisation.
Checked against SOC 2 Type 2 report (Ernst & Young LLP) held in the TrustyCyber vault, obtained from Google's Compliance Reports Manager, Sep 1, 2026: Verified on the registry
The products-in-scope list names Generative AI on Vertex AI and the Vertex AI Platform explicitly, along with Vertex AI Search, Conversation, Codey, Colab Enterprise and Workbench Instances - so the assessed product is well covered rather than incidentally included. IRAP is an assessment against OFFICIAL and PROTECTED ISM controls, not a certification with an expiry, and no public register exists to confirm it.
Checked against Google Cloud IRAP compliance offering page, captured to the TrustyCyber vault 28 August 2026 (Gated/Google/2026-08_google-cloud-irap-offering-snapshot.md), Sep 1, 2026: Verified on the registry
Checked against Data Privacy Framework (dataprivacyframework.gov), Sep 1, 2026: Verified on the registry
Checked against CSA STAR Registry, Sep 1, 2026: Verified on the registry
Checked against FedRAMP Marketplace (fedramp.gov), Sep 1, 2026: Verified on the registry
Sources 20 — click to view
Appendix: standards landscape 8 — click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.