Vertex AI

Google states it will not use customer data to train or fine-tune any AI/ML models without prior permission or instruction, and that this covers all managed models on the platform including pre-GA models.

Customer data is retained for limited periods in defined situations, and reaching zero data retention requires the customer to act in each of those areas rather than it being the default.

Requires written confirmation — see Before you sign ↓

Google publishes a Google Cloud Platform subprocessor register showing the relevant service and applicable cloud region for each subprocessor.

Requires written confirmation — see Before you sign ↓

Not found in the public sources scanned — ask the vendor directly.

Requires written confirmation — see Before you sign ↓

Not found in the public sources scanned — ask the vendor directly.

Confirm in writing: Ask the vendor to state this in writing before signing.

Google commits not to use customer data to train or fine-tune AI/ML models without prior permission, and states the commitment covers all managed models on the platform including those not yet generally available.

Pre-release models are exactly where training commitments usually carve out, so extending the restriction to them is a substantive addition rather than boilerplate. It is vendor-published, so it belongs in the contract rather than relied on from a documentation page.

Customer data is retained for limited periods in defined situations, and the documentation states that achieving zero data retention requires the customer to take specific actions in each of those areas.

Buyers routinely read "zero data retention" as a property of the platform. Here it is an outcome the customer must configure and request, so an organisation assuming it by default would be wrong about where its prompts are held.

Question for vendor: What is the current retention and abuse-logging state for our projects, and has an abuse-monitoring exception been granted?

Google's own Service Specific Terms refer to "Gemini Enterprise Agent Platform (formerly Vertex AI Platform)". This assessment was requested under the former name.

Contract terms already use the new name and documentation is moving to it, so procurement paperwork naming only "Vertex AI" may not match what is being bought. The two names refer to the same platform.

Beyond the training restriction and retention documentation, the collected evidence is Google Cloud organisation-level: the DPA, the subprocessor register and the compliance pages. No platform-specific certification scope or security documentation was retrieved.

Organisation-level evidence legitimately applies to the platform, but it cannot answer whether a certificate's scope actually names it. That distinction is where AI assurance usually fails, and it is unresolved here.

Question for vendor: Which certifications name Gemini Enterprise Agent Platform within their scope statements?

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a model provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Google appears to be involved as a model provider: confirm whether this dependency exists, and whether it processes customer data.

Technical evidence (DNS, certificate, or HTTP) shows a dependency on Microsoft as a service provider. This dependency is not identified in the vendor's published materials.

An undisclosed provider dependency is exactly the gap independent verification exists to surface.

Question for vendor: Verification required — Microsoft appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.