// Trust & Security Report
Google LLC
Google Assistant is a consumer-facing AI voice assistant available on phones, tablets, smart displays, smart speakers, watches, TVs, and connected devices. Note: This assessment covers the free consumer product at assistant.google.com; separate enterprise certifications apply to Google Cloud services (Cloud Platform, Workspace) that may power backend infrastructure but are distinct products.
Certifications held
0
Maturity
Enterprise
Trains on your data
Yes
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
> Show 9 unconfirmed / not-held certifications
source: cloud.google.comSOC 2 Type II certification applies to Google Cloud Platform services, not to the consumer Google Assistant product. Google Assistant consumer product is not explicitly included in Google Cloud's SOC 2 certification scope.
source: cloud.google.comISO/IEC 27001 certification applies to Google Cloud Platform and Google Workspace services. Google Assistant consumer product does not hold this certification independently.
source: cloud.google.comISO/IEC 27017 certification is held by Google Workspace and Google Cloud, not by the consumer Google Assistant product.
source: cloud.google.comISO/IEC 27018 certification is held by Google Workspace and Google Cloud, not by the consumer Google Assistant product.
source: cloud.google.comISO/IEC 27701 (privacy information management) certification is held by Google Cloud Platform, Google Workspace, and specific Gemini Enterprise editions. Consumer Google Assistant does not hold this certification.
source: cloud.google.comGDPR compliance and data processing agreements are available for Google Cloud and Google Workspace customers. Google Assistant consumer product is governed by Google's general privacy policy but does not hold GDPR business customer certifications.
source: support.google.comGoogle explicitly states: 'Google is not able to commit that the Actions on Google platform can meet the requirements of HIPAA.' Google Assistant Actions do not allow transmission of information that could be considered protected health information (PHI) under HIPAA.
source: cloud.google.comPCI DSS certification applies to Google Cloud Platform services for payment card data processing. Consumer Google Assistant product does not hold this certification.
source: cloud.google.comFedRAMP authorization applies to Google Cloud Platform. Consumer Google Assistant product is not a FedRAMP-authorized service.
// Privacy & AI training
Trains on customer data
Yes
Data processing agreement
Not offered
Data region
Multiple regions (US, EU, and others based on user location)
Google uses consumer data to train and improve Google's AI models. For consumer Google Assistant: (1) A subset of chats/interactions are reviewed by human reviewers to improve services, with audio disconnected from accounts before review. (2) Gemini Apps chats may be reviewed to assess quality/accuracy/harm. (3) Users can disable 'Include voice and audio activity' to prevent recordings from being saved and used for training. (4) For Google Workspace/enterprise customers: Google does not use Workspace data to train generative AI models outside of Workspace without permission.
// Security controls
Encryption in Transit
Data is encrypted when it moves between devices, Google services, and data centers using 'leading encryption technology'
support.google.comData Retention Control
Users can delete activity, control voice and audio recording retention. Audio recordings are not stored by default unless user enables 'Include voice and audio activity'.
support.google.comMulti-layer Security
Google Assistant includes multiple layers of security and built-in security features to protect against threats online
support.google.comNo Sale of Personal Data
Google does not sell personal information, including audio recordings
support.google.comChildren's Data Protection
Google does not share personal information from children's Google Accounts with third parties (names, emails, voice recordings, location)
support.google.comMute Controls
Devices with Google Assistant include physical mute buttons and camera switches for user control
support.google.com// Products & data scope
data: Voice queries, device control commands, user preferences, contacts (with permission), location (with permission), Google Account information
Available on phones, tablets, smart displays, smart speakers, watches, TVs. Free consumer product. Does not support PHI/medical data. Cannot guarantee HIPAA compliance per official policy.
data: User commands and interactions with third-party services (e.g., Spotify, Netflix, Walmart)
Actions cannot transmit PHI or medical information. Google explicitly states inability to meet HIPAA requirements.
// What to watch
- CRITICAL DISTINCTION: Google Cloud Platform (enterprise) holds SOC 2, ISO 27001, GDPR, HIPAA certifications. Consumer Google Assistant does NOT inherit these certifications. These are separate products with different compliance scopes.
- Google Assistant Actions explicitly cannot support HIPAA PHI data - verified on official Google support pages. Any healthcare use case would be non-compliant.
- Consumer product is NOT enterprise-certified but uses Google Cloud infrastructure which IS certified. Users should not assume consumer product compliance based on Google Cloud certifications.
- AI training: Consumer Google Assistant chats/audio may be reviewed by humans to improve services. Enterprise Workspace data is protected from training use without consent.
- No Data Processing Agreement (DPA) available for consumer Google Assistant - DPAs only for Workspace/Cloud customers.
// At a glance
Pricing model
Free (consumer); Premium features available in Google One AI plans
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Google LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-06. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
policies.google.com