Gemini via Vertex AI

Google Cloud lists Gemini (via Vertex AI) in the SOC 2 Type II scope and states reports are available through the Compliance Reports Manager, which requires portal access, confirming availability but behind a gate.

Customers can request the reports at their convenience via Compliance Reports Manager... Services in scope ... **Generative AI on Gemini Enterprise Agent Platform (Formerly Generative AI on Vertex AI)**

source

Google's Gemini certifications page publicly lists ISO 27001 as a compliance certification for Gemini products in Google Cloud, which includes Gemini via Vertex AI.

ISO 27001, ISO 27017, ISO 27018, ISO 27701 | Yes

source

The provider’s own compliance page explicitly states Gemini (the Google AI model) is ISO/IEC 42001 certified, confirming a publicly verifiable certification.

Google Cloud, Google Workspace, and Gemini (App) are certified as ISO/IEC 42001:2023 compliant.

source

Google Cloud's Trust Center page publicly lists a compliance resource center, confirming a maintained compliance portal for Gemini via Vertex AI.

You can find details on our full set of compliance offerings, like ISO/IEC 27001/27017/27018/27701, SOC 1/2/3, PCI DSS, and FedRAMP certifications, and alignment with GDPR, and HIPAA in our Compliance resource center.

source

The Google Cloud HIPAA compliance page publicly lists Gemini Enterprise as a product covered by the Business Associate Addendum, confirming a public BAA applies to Gemini via Vertex AI.

"- Gemini Enterprise" (listed among the Google Cloud products included in the HIPAA BAA)

source

The public Google Cloud Data Processing Addendum defines Customer SCCs and provides a direct link to a publicly accessible subprocessor list, satisfying the DPA with SCCs and subprocessor list requirement.

"Customer SCCs" means the SCCs (Controller-to-Processor), the SCCs (Processor-to-Processor) and/or the SCCs (Processor-to-Controller), as applicable. ... Names, locations and activities of Subprocessors are described at: a. https://cloud.google.com/terms/subprocessors for Google Cloud Platform; and. b. https://workspace.google.com/intl/en/terms/subprocessors.html ...

source

The provider's own public documentation explicitly states a training restriction, confirming a public commitment not to train on customer API data by default.

Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform, including GA and pre‑GA models.

source

The provider’s own documentation explicitly describes data retention policies and outlines steps to achieve zero data retention for Gemini via Vertex AI.

Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time ... To achieve zero data retention, customers must take specific actions within each of these areas:

source

The official Vertex AI data residency documentation explicitly states that using EU jurisdictional or locational endpoints pins ML processing to the EU, confirming public self‑serve region pinning.

"Jurisdictional multi-region endpoints: When you use jurisdictional endpoints, ML processing stays within that specific geographical region (such as the United States or the European Union)." "Locational endpoints: These endpoints (like `europe-west1`) ensure that ML processing remains entirely within the broader multi‑regional or country jurisdiction associated with that region (for example, requests to us-central1 are processed within the United States)."

source

The EU Commission Vademecum lists Google among the participating signatories of the GPAI Code of Practice, confirming the model developer is a signatory.

Google

source

Google has posted a publicly accessible PDF on its own domain that follows the EU AI Act Article 53 template and provides the training‑data summary for the Gemini 3 Pro model family.

Public Summary of Training Content for General-Purpose AI models ... Versioned model name(s): The Gemini 3 Pro family of models

source