// Trust & Security Report
Google LLC (Alphabet Inc.)
Google Workspace for Education: a suite of cloud-based learning management and productivity tools for K-12 and higher education, including Google Classroom (LMS), Gemini in Classroom (generative AI assistant), NotebookLM (AI-powered research notebook), Google Meet, and Read Along in Classroom
Certifications held
16
Maturity
Enterprise
Trains on your data
No
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on workspace.google.com“An independent third-party auditor has verified that Google's practices and contractual commitments for Google Workspace for Education are audited against SSAE 18 / ISAE 3402 Type II. SOC 2 Type II reports are issued quarterly and available via the Compliance Reports Manager.”
Verify on cloud.google.com“Google Cloud and Google Workspace SOC 1 Type II reports are issued quarterly and downloadable via Compliance Reports Manager.”
Verify on workspaceupdates.googleblog.com“Gemini for Google Workspace is now SOC 1, SOC 2, and SOC 3 compliant. SOC 3 reports are publicly available.”
Verify on edu.google.com“ISO/IEC 27001 (Security) — listed directly on the Google for Education Privacy and Security page as a standard met by Google Workspace for Education via third-party audits.”
Verify on knowledge.workspace.google.com“Google ensures that Google Workspace products covered under the BAA align with ISO/IEC 27017 certifications and SOC 2 report. Google Workspace holds ISO/IEC 27017 (Cloud Security) certification.”
Verify on knowledge.workspace.google.com“Google ensures that Google Workspace products covered under the BAA align with ISO/IEC 27018 certifications. Google Workspace holds ISO/IEC 27018 (Cloud Privacy) certification.”
Verify on edu.google.com“ISO/IEC 27701 (Privacy) — listed directly on the Google for Education Privacy and Security page as a standard met by Google Workspace for Education via third-party audits.”
Verify on edu.google.com“ISO/IEC 42001 (AI) — listed directly on the Google for Education Privacy and Security page. Google achieved ISO 42001 certification for the Gemini app on web and mobile in December 2024; Google Cloud Platform and Google Workspace are certified as ISO/IEC 42001:2023 compliant.”
Verify on edu.google.com“EU/EEA: GDPR (General Data Protection Regulation) — listed as a compliance standard on the Google for Education Privacy and Security page. A Cloud Data Processing Addendum (DPA) is available.”
Verify on edu.google.com“US: FERPA (Family Educational Rights and Privacy Act) — explicitly listed on the Google for Education Privacy and Security page as a US compliance standard met by Google Workspace for Education.”
Verify on edu.google.com“US: COPPA (Children's Online Privacy Protection Act of 1998) — explicitly listed on the Google for Education Privacy and Security page as a US compliance standard met by Google Workspace for Education.”
Verify on knowledge.workspace.google.com“Customers subject to HIPAA may enter a Business Associate Amendment (BAA) with Google. The Gemini app on web and mobile achieved HIPAA certification in December 2024. Google ensures Google Workspace products covered under the BAA meet HIPAA requirements.”
Verify on workspaceupdates.googleblog.com“Gemini for Workspace achieved FedRAMP High authorization as announced in October 2024. The entire authorized Google Workspace security boundary is documented, assessed, and managed against the FedRAMP High baseline.”
Verify on cloudsecurityalliance.org“Google Cloud has achieved third-party assessment-based certification (CSA STAR Level 2: Attestation) for Google Cloud and Google Workspace, resulting in a CSA STAR SOC2+ report.”
Verify on cloud.google.com“Google Workspace compliance certifications include PCI DSS. Google Cloud undergoes at least an annual third-party audit to certify individual products against PCI DSS 4.0.1.”
Verify on edu.google.com“US: Software and Information Industry Association — listed on the Google for Education Privacy and Security page as a US compliance standard met by Google Workspace for Education.”
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Offered
Data region
Data region control available for Education Plus and Education Standard editions. Admins can set data regions per organizational unit or configuration group. Global by default on Fundamentals.
Google explicitly states: 'no Google Workspace for Education data is used to improve or train AI models' and 'Chats with Gemini are not human reviewed or otherwise used to improve AI models.' This applies to all editions (Fundamentals and Plus). Admin-controlled access governs generative AI features.
// Security controls
Encryption in transit
TLS enforced for all data in transit across Google Workspace services including Classroom
workspace.google.comEncryption at rest
AES-256 encryption at rest; hardware security modules protect encryption keys
workspace.google.comUptime SLA
99.9% guaranteed uptime (99% stated on edu.google.com); global full-stack network
edu.google.comIdentity and access management
2-factor authentication, Single Sign-On (SSO), and password management supported. Centralized Admin Console for domain-wide security settings
edu.google.comThreat detection
AI-powered proactive monitoring 24/7; automatic blocking of 99.9%+ of spam, phishing, and malware in Gmail; Security Center with real-time alerts
edu.google.comAudit logging
User activity log events available for detecting unsafe operations; Classroom logs exportable to BigQuery for adoption and engagement analysis
edu.google.comAdmin console
Centralized Admin Console with controlled entry, domain-wide security settings, DLP rules, and data region policies
workspace.google.comThird-party audits
Regular independent third-party audits verifying security, privacy, and compliance controls; reports available via Compliance Reports Manager at no additional cost
cloud.google.com// Products & data scope
data: Student and educator data, assignments, grades, class materials, originality reports. No ads. No use of data for AI model training.
Free tier for schools. Includes Gemini AI tools at no cost as of 2024. FERPA and COPPA compliant. Data owned by the institution.
data: All Fundamentals scope plus analytics data, SIS integration data, BigQuery export. Data region control available.
Paid tier. Adds Classroom analytics for leaders, data region selection, advanced security controls.
data: Conversation content from educator/student AI interactions; not used to train AI models; Gemini chats not human-reviewed
SOC 1/2/3, ISO 42001, HIPAA (Dec 2024), FedRAMP High (Oct 2024). Admin-controlled feature rollout.
data: Documents and materials uploaded by users; processed to generate summaries, Q&A, audio overviews
Available as part of Workspace for Education through Gemini in Classroom teacher-led experiences.
data: Student reading sessions, accuracy and speed data, comprehension metrics; educator analytics
Available globally for K-12 students; real-time AI feedback on reading aloud. Part of Google Workspace for Education services.
data: Same as Gemini in Classroom scope; enterprise-grade data protection in Gemini applies
Paid add-on with advanced Gemini capabilities for education customers. Available since 2025.
// What to watch
- HIPAA note: HIPAA compliance requires institutions to accept a Business Associate Amendment (BAA) with Google before using PHI. Not automatic. Education-tier HIPAA coverage was explicitly confirmed for the Gemini app in December 2024.
- FedRAMP scope: FedRAMP High authorization announced October 2024 for Gemini for Workspace. The full Google Workspace boundary is managed against FedRAMP High, but education institutions must verify their specific configuration and edition qualify.
- ISO 42001 was obtained specifically for the Gemini app on web and mobile in December 2024. While Google Workspace and Google Cloud Platform are listed as ISO 42001:2023 certified, Classroom-specific scope should be confirmed for formal procurement.
- PCI DSS and CSA STAR certificates are at the Google Cloud and Google Workspace platform level; they cover the underlying infrastructure Google Classroom runs on, not Classroom as a standalone certified product.
- Data region control is edition-gated: only available on Education Standard and Education Plus, not on the free Education Fundamentals tier. Institutions requiring data residency guarantees must use a paid edition.
- The slug 'google-classroom-ai' is a catalog artifact; the official product name is Google Classroom, part of Google Workspace for Education, made by Google LLC.
// At a glance
Pricing model
Freemium: Education Fundamentals is free; Education Standard and Education Plus are paid; add-ons (Google AI Pro for Education, Teaching and Learning upgrade) available separately
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Google LLC (Alphabet Inc.)'s own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-27. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
workspace.google.com