Is Gemini Safe for Confidential Information? The App, Workspace, Gemini Enterprise and the API

Is Gemini safe for confidential information? Not on a personal Google Account: chats are saved for 18 months by default, can train Google's models and may be read by human reviewers, and Google itself tells users not to enter confidential information. Gemini in Google Workspace, Gemini Enterprise, the paid Gemini API and Agent Platform are not used for training, but every one of them is a Google-hosted service.

“Gemini” is a model family and at least four products. The Gemini app at gemini.google.com is a consumer service when you sign in with a personal account, whether free or on a Google AI Plus, Pro or Ultra subscription. Gemini in Google Workspace is the same assistant under your organisation’s Workspace agreement. Gemini Enterprise is a separate Google Cloud product for search and agents across company systems. Developers reach the models through the Gemini API or through Gemini Enterprise Agent Platform, the service Google used to call Vertex AI. The terms differ at each door.

Everything below was read on Google’s own pages on 14 November 2026: the Gemini Apps Privacy Hub, the Workspace generative AI privacy hub, the Gemini Enterprise documentation, the Gemini API terms and the Agent Platform data governance pages. Costs are a separate question, covered in our breakdown of Gemini Enterprise editions and seat costs.

Gemini data handling by plan

The second half of the question is where the data sits and what your organisation can enforce.

Is Gemini safe to use on a personal Google Account?

For questions you would happily type into a search engine, yes. For employer or client material, no, and Google says so in plain words. The Gemini Apps Privacy Notice, last updated on 13 October 2026, asks users not to “enter confidential information that you wouldn’t want a reviewer to see”.

The setting that decides most of this is Keep Activity, which controls what is saved to your Gemini Apps Activity. Google’s help page states that it is on by default for anyone aged 18 or over. While it is on:

• Chats are saved and used. Google uses the activity to provide, develop and improve its services, and the notice says that includes training generative AI models.
• Auto-delete defaults to 18 months. You can change it to 3 months or 36 months, or switch auto-delete off.
• People may read a sample. Human reviewers, including staff at Google’s service providers, check chats for quality and safety. Google says it disconnects those chats from the account first. Reviewed chats are kept for up to three years and are not removed when you delete your activity.

Google’s hub makes no exception for paid subscribers. Google AI Plus, Pro and Ultra buy higher limits and newer models; on a personal account the same notice applies to them.

Uploads and voice follow their own rules. Images you attach are treated like other prompts. Gemini Live audio, video and screen shares are not used to improve Google’s services unless you turn on a separate setting, which is off by default. Apps you connect to Gemini handle data under their own policies.

Does Gemini train on your data, and how do you turn it off?

On a personal account, open Gemini Apps Activity and turn Keep Activity off. Google’s help page describes what changes and what does not:

1. Future chats are no longer used to train Google’s models, unless you send feedback on a response, in which case the surrounding conversation goes with it.
2. Chats are still saved with your account for up to 72 hours so the service can respond and Google can process feedback. They do not appear in your activity.
3. Anything already sent to reviewers stays for its three-year period.

A temporary chat gives you the same treatment for one conversation without changing the setting: it is not used for training and is held for 72 hours.

Two limits matter for work. First, the switch belongs to the individual, so an employer cannot see or enforce it on a personal account. Second, it changes what Google does with the text, not who is the customer. There is still no data processing agreement between Google and your organisation for that account. That is the gap most AI acceptable use policies close by banning personal accounts for company data.

Is Gemini safe for work in Google Workspace?

A Workspace seat is the first tier where the answer becomes “yes, for most business data”. Google’s Workspace privacy hub, last updated on 6 October 2026, says Workspace does not use customer data to train models without the customer’s prior permission or instruction, and that content is not human reviewed or used for generative AI training outside your domain without permission. The Gemini app is now a core Workspace service for most editions and is on by default, so staff who sign in with a work account are inside these terms without doing anything.

What administrators control:

• Retention. Prompts and responses in the Workspace apps are kept from 90 days to indefinitely, as admins decide. Gemini app conversations are kept for up to 36 months, as admins decide, with 18 as the default, and are held for up to 72 hours when conversation history is off. Feedback data can be kept for up to 18 months.
• Access to content. Gemini works with the permissions a user already has. Information rights management and client-side encryption can keep specific files out of its reach, and cross-app grounding is off by default for files shared from outside the domain.
• Monitoring. Audit logs for the Gemini app and the Workspace apps are available through the Reporting API, Vault manages retention for Workspace data, and data loss prevention rules apply to Gemini output inserted into Gmail, Drive and Docs.

Google lists SOC 1, 2 and 3, ISO 9001, ISO/IEC 27001, 27017, 27018, 27701 and 42001, and FedRAMP High authorisation for Gemini in the Workspace apps and the Gemini app, and says Gemini can support HIPAA workloads. The hub answers the same questions separately for Gemini Notebook, formerly NotebookLM, and for Gemini in Chrome, so check those two on their own before sending regulated data through them.

The risk that remains is the one every embedded assistant has. Gemini can find and summarise anything the user is allowed to open, so files shared too widely become easier to find. Clean up sharing before you roll it out.

Is Gemini Enterprise safe?

Gemini Enterprise is sold through Google Cloud in Business, Standard, Plus, Frontline and Pay-as-you-go editions. Its security overview states that it does not use prompts, generated responses or connected enterprise data to train Google’s foundation models, whether the data is ingested or reached through federated search, and that the data remains isolated within your Google Cloud project. It also says Gemini Enterprise deletes user-requested data within 60 days.

The controls are real but uneven across editions and features:

• Google’s compliance table documents data residency, customer-managed encryption keys, VPC Service Controls and Access Transparency for Standard and Plus. Business does not appear in that table.
• Customer-managed keys work only with the US and EU multi-region APIs, and neither they nor Access Transparency are supported in the global location.
• A footnote says those four controls do not apply when Grounding with Google Search is enabled.
• Traffic from third-party connectors to outside systems is not governed by your VPC Service Controls perimeter, and outbound connections come from Google’s address ranges, not your network.

Sign-in uses Google Identity or Workforce Identity Federation, which is how a third-party identity provider is attached.

One incident is worth knowing. In May 2025, Noma Security reported a flaw it called GeminiJack. A document, calendar invite or email carrying hidden instructions could be picked up by Gemini Enterprise during an employee’s ordinary search and used to pull emails, calendar entries and documents out of the organisation, with no click by the victim. SecurityWeek reported on 10 December 2025 that Google confirmed the findings and had mitigated the issue. The lesson is general: an assistant with access to everything you connect will also read what attackers send you.

Is the Gemini API safe? Paid and unpaid tiers

The Gemini API terms, effective 23 March 2026, split usage in two.

Unpaid services. Google uses what you submit and what the model returns to provide, improve and develop its products, and human reviewers may read and annotate it after it is disconnected from your account, API key and Cloud project. The terms then tell developers not to submit sensitive, confidential or personal information to the unpaid services.

Paid services. Google does not use prompts or responses to improve its products and processes them under its data processing addendum for processor services. It still logs prompts and responses for a limited period to detect policy violations, and the terms do not put a number on that period. With Grounding with Google Search, prompts, context and output are stored for 30 days.

Three details catch teams out:

1. “Paid” is about billing, not the price of the call. API usage counts as paid only when it goes through a Cloud project with an active billing account. Google AI Studio counts as paid when the account has such a project.
2. Europe is treated differently. In the EEA, Switzerland and the UK, the paid-services data terms apply to all usage, including the free quota.
3. Zero data retention is a set of settings. On Agent Platform, Google documents the steps: leave request logging off, set store to false on Interactions API requests, do not enable Live API session resumption, and turn off caching.

On Agent Platform, cached inputs are deleted within 24 hours, and a project admin can switch caching off with the command Google documents. The change applies to every region:

curl -X PATCH \
    -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
    -H "Content-Type: application/json" \
    https://us-central1-aiplatform.googleapis.com/v1/projects/PROJECT_ID/cacheConfig \
    -d '{
      "name": "projects/PROJECT_ID/cacheConfig",
      "disableCache": true
    }'

Abuse monitoring is the remaining exception. For customers on Google Cloud’s online terms, prompts flagged by safety classifiers can be logged for up to 90 days in the project’s region and assessed by authorised Google employees. Customers with a Google Cloud Master Agreement are exempt from that logging by default. Some advanced partner models, and Google’s own Frontier models, log prompts and responses for up to 30 days whatever the contract says, so confirm per model. Our zero data retention explainer compares these terms across providers.

Is Gemini safe for privacy? Verified incidents

Policy is one half of the picture. The other is how the product behaves when someone attacks it. Two disclosures are well documented, and Google fixed both:

• GeminiJack, Gemini Enterprise. Reported by Noma Security in May 2025 and made public in December 2025, described above.
• Calendar invite injection, Gemini with Google Calendar. On 19 January 2026, The Hacker News reported research by Miggo Security. A calendar invite with a dormant instruction in its description caused Gemini, when the user later asked about their schedule, to write a summary of private meetings into a new event that the attacker could read. The issue was addressed after responsible disclosure.

Both are indirect prompt injection: the attacker plants content that Gemini later reads. A no-training clause prevents neither.

We found no regulator decision against Gemini on confidentiality grounds that we could verify on a primary source, so none is cited here. Other assistants raise the same questions under different terms. We answer them separately for ChatGPT’s plans, Claude from Free to Enterprise, consumer and Microsoft 365 Copilot and DeepSeek’s app, API and open weights.

Using Gemini at work: steps for employees and IT

If you use Gemini at work:

1. Check which account you are signed in with. The profile picture in the corner tells you whether it is your work or personal Google Account.
2. Keep client names, contracts, source code, credentials, health and financial data out of a personal account, whatever the Keep Activity setting.
3. On a personal account, turn Keep Activity off and set auto-delete to 3 months for anything that remains.
4. Do not send feedback on a response that contains sensitive text; feedback carries the conversation to Google.
5. Treat documents, invites and emails from outside as untrusted before you ask Gemini to summarise them.

If you run IT or security:

1. Decide which Gemini products are approved and write it down by data class.
2. In Workspace, set Gemini retention deliberately, review sharing settings before enabling cross-app features, and switch on audit log export.
3. Block or monitor personal Google sign-ins on managed devices. Unapproved use is the main exposure.
4. For developers, require a billed Cloud project for every API key and ban the unpaid tier for company data.
5. For Gemini Enterprise, choose a us or eu location if you need customer-managed keys, and decide whether Google Search grounding is worth losing the residency and perimeter controls.
6. If you handle EU personal data, map each product to a legal basis and a transfer mechanism; our GDPR and AI tools guide lists the questions to ask.

When the data must not leave your infrastructure

Every Gemini product described here runs in Google’s data centres. Google’s terms can make that a sound processor arrangement, and for most business data it is enough. Some rules cannot be met by a contract: client agreements that forbid third-party processing, classified or export-controlled work, and regulators that expect a named location under your control. Google does not publish Gemini’s weights for download, so “run Gemini ourselves” is not an option in the way it is for an open-weight model.

The alternative is a model you host, chosen and tested on your own tasks. Our private and public LLM comparison covers the trade-offs in quality, cost and operations.

How VDF AI fits

VDF AI does not run, host, resell or integrate with Gemini in any of its forms: the Gemini app, Gemini in Workspace, Gemini Enterprise or the Gemini API. It is a separate, self-hosted platform for chat, retrieval over company documents and governed agents, deployed on-premises, in a private cloud or air-gapped, with conversation history and audit records kept in storage the organisation controls.

In VDF AI Chat each agent is assigned a model, and VDF AI Router registers on-premises deployments alongside the cloud models an administrator approves; its air-gap mode restricts routing to local models. That lets an organisation keep contracts, client files and source code on models it runs while still deciding, by policy, what may go to a hosted model. Role-based access control applies on every plan. To talk through a deployment, contact the team.