AI Vendor Directory · Foundation model APIs
Does Google Gemini API train on your data?
Depends — varies by plan or setting. Vendor-stated default: no (Vertex AI; also Gemini Developer API PAID tier). UNPAID Gemini Developer API tier: yes. Vertex AI (Google Cloud terms): Google will not use customer data to train or fine-tune any AI/ML models without prior permission or instruction; Gemini inputs are cached up to 24h by default (disable caching for zero data retention) and prompts may be logged for abuse monitoring, with opt-out available. The separate Gemini Developer API (ai.google.dev) splits by tier: Paid Services — 'Google doesn't use your prompts... or responses to improve our products'; Unpaid Services — 'Google uses the content you submit... and any generated responses to provide, improve, and develop Google products and services,' including human review; Google warns not to submit confidential data on the unpaid tier. Note: the Vertex data-governance page did not render for automated fetch; wording verified live via search index of the vendor page on 2026-07-29.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Google Gemini API (Vertex AI)?
Gemini models served through Google Cloud's Vertex AI platform (and the separate Gemini Developer API). SMBs use it for chat, RAG over their data, and multimodal features under GCP terms.
Key facts
- Vendor: Google — https://cloud.google.com/vertex-ai
- Trains on customer data by default: no (Vertex AI; also Gemini Developer API PAID tier). UNPAID Gemini Developer API tier: yes
- Source for the training answer: https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance
- Data residency: US; EU; Global (customer-selected Google Cloud regions; ML processing commitments per region)
- Last verified: 2026-07-29
What certifications does Google Gemini API hold?
- SOC 1/2/3 (Google Cloud — Vertex AI in scope)
- ISO/IEC 27001, 27017, 27018 (Google Cloud)
- HIPAA BAA available (covered Google Cloud service)
Security, DPA, and subprocessor links
- Security / trust page: https://cloud.google.com/security/compliance
- Data processing agreement (DPA): https://cloud.google.com/terms/data-processing-addendum
- Subprocessor list: https://cloud.google.com/terms/subprocessors
What is your EU AI Act role when you build on Google Gemini API?
Building on Vertex AI/Gemini typically makes you the provider of your downstream AI system under the EU AI Act, with Article 50 transparency duties for your end users; Google holds GPAI model-provider obligations for Gemini.
What to record in your AI registry
- Provider: Google
- Model type: third party api
- Data typically flowing to the vendor: prompts, completions, grounding/RAG corpus data, images/video/audio inputs
Sources
- https://ai.google.dev/gemini-api/terms
- https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance
- https://cloud.google.com/terms/data-processing-addendum
- https://cloud.google.com/terms/subprocessors
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Google Gemini API train AI models on your data?
Depends — varies by plan or setting. Vendor-stated default: no (Vertex AI; also Gemini Developer API PAID tier). UNPAID Gemini Developer API tier: yes. Vertex AI (Google Cloud terms): Google will not use customer data to train or fine-tune any AI/ML models without prior permission or instruction; Gemini inputs are cached up to 24h by default (disable caching for zero data retention) and prompts may be logged for abuse monitoring, with opt-out available. The separate Gemini Developer API (ai.google.dev) splits by tier: Paid Services — 'Google doesn't use your prompts... or responses to improve our products'; Unpaid Services — 'Google uses the content you submit... and any generated responses to provide, improve, and develop Google products and services,' including human review; Google warns not to submit confidential data on the unpaid tier. Note: the Vertex data-governance page did not render for automated fetch; wording verified live via search index of the vendor page on 2026-07-29.
What certifications does Google Gemini API hold?
Per the vendor's published pages as of 2026-07-29: SOC 1/2/3 (Google Cloud — Vertex AI in scope); ISO/IEC 27001, 27017, 27018 (Google Cloud); HIPAA BAA available (covered Google Cloud service).
Where does Google Gemini API store your data?
Vendor-listed data residency options as of 2026-07-29: US; EU; Global (customer-selected Google Cloud regions; ML processing commitments per region).
What is your EU AI Act role when you build on Google Gemini API?
Building on Vertex AI/Gemini typically makes you the provider of your downstream AI system under the EU AI Act, with Article 50 transparency duties for your end users; Google holds GPAI model-provider obligations for Gemini.
