Gemini via Vertex AI

The provider's own page confirms the SOC 2 Type II report covering Generative AI on Vertex AI is served to customers via the Compliance Reports Manager portal, which meets the sales/portal-gated threshold rather than a fully public download.

Customers can request the reports at their convenience via Compliance Reports Manager... Generative AI on Gemini Enterprise Agent Platform (formerly Generative AI on Vertex AI)

source

Google Cloud’s Gemini certifications page lists ISO 27001 as ‘Yes’, confirming the offering is publicly covered by the certification.

ISO 27001, ISO 27017, ISO 27018, ISO 27701 | Yes

source

The provider’s own compliance page publicly lists Gemini (App) as ISO/IEC 42001 certified, confirming the model’s certification.

Google Cloud Platform, Google Workspace, and Gemini (App) are certified as ISO/IEC 42001:2023 compliant.

source

Verified the quote verbatim on Google Cloud's own trust center page (authoritative for the platform serving Gemini via Vertex AI); it is a maintained compliance/trust portal with no access gate, so yes_public is correct.

You can find details on our full set of compliance offerings, like ISO/IEC 27001/27017/27018/27701, SOC 1/2/3, PCI DSS, and FedRAMP certifications, and alignment with GDPR, and HIPAA in our Compliance resource center.

source

Google's own compliance page states it "will enter into Business Associate Agreements with customers as necessary under HIPAA" and lists Vertex AI among BAA-covered products, so no_public_evidence is wrong; execution is routed through an account manager per Google's FAQ, making it yes_sales_gated ra

In order to execute a BAA, organizations that use Google Cloud should talk to their account managers about entering into a BAA with us.

source

Google's public Data Processing Addendum explicitly defines Customer SCCs, confirming a public DPA with SCCs, and the public subprocessor list page confirms a published list for Gemini via Vertex AI.

"Customer SCCs means the SCCs (EU Controller-to-Processor), the SCCs (EU Processor-to-Processor), the SCCs (EU Processor-to-Controller), and/or the SCCs (UK Controller-to-Processor), as applicable."

source

The public Google Cloud docs state a training restriction covering all Gemini models, confirming a public commitment not to train on customer API data by default.

Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction. This applies to all managed models on Gemini Enterprise Agent Platform, including GA and pre-GA models.

source

The Google Cloud page publicly documents data retention policies and provides specific actions for achieving zero data retention for Gemini via Vertex AI.

Customer data is retained in Gemini Enterprise Agent Platform for Models as a Service (MaaS) for limited periods of time... To achieve zero data retention, customers must take specific actions within each of these areas:

source

Google Cloud’s Vertex AI documentation publicly states that using EU jurisdictional multi‑region or EU locational endpoints pins ML processing to the EU, confirming data residency capability for Gemini.

"Jurisdictional multi‑region endpoints: When you use jurisdictional endpoints, ML processing stays within that specific geographical region (such as the United States or the European Union)." "Locational endpoints (like `europe‑west1`) ensure that ML processing remains entirely within the broader multi‑regional or country jurisdiction associated with that region (for example, requests to us-central1 are processed within the United States)."

source

Verified: the EC Vademecum's "List of participating signatories in the Taskforce" is on the Commission's own domain and includes "Google", confirming the recorded value.

Google

source

Google's Transparency Report page lists a downloadable public summary for the Gemini 3 model family, satisfying the Article 53 developer obligation.

DOWNLOADABLE REPORT EU AI Act Public Summary of Training Content for General-Purpose AI Models - Gemini 3 model family. Detailed summary of the content used for training a general-purpose AI model.

source