// Trust & Security Report
Google LLC
Veo, Google DeepMind's video generation model. Reaches users through three distinct surfaces: consumer creative tools (Google Flow, and "Try in Gemini" inside the Gemini app, both requiring a paid Google AI Pro/Ultra plan for Veo access), the developer Gemini API / Google AI Studio, and the enterprise "Generative AI on Vertex AI" platform (part of what Google now brands the Gemini Enterprise Agent Platform). Compliance posture and data-training behavior differ sharply between the consumer surfaces and the enterprise/API surface.
Certifications held
7
Maturity
Enterprise
Trains on your data
Unknown
Trust center
Yes
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on cloud.google.com“Google Cloud's services-in-scope compliance matrix lists the row 'Generative AI on Vertex AI' (the platform hosting Veo, per https://docs.cloud.google.com/vertex-ai/generative-ai/docs/models/veo/3-1-generate) with checkmarks under the SOC 1, SOC 2, and SOC 3 report columns.”
Verify on cloud.google.com“The same services-in-scope matrix lists 'Generative AI on Vertex AI' with checkmarks under the ISO 27001, ISO 27017, and ISO 27018 certification columns.”
Verify on cloud.google.com“"[Audited Services] means the then-current Services indicated as being in-scope for the relevant certification or report at cloud.google.com/security/compliance/services-in-scope" and "Google is a processor and Customer is a controller or processor, as applicable, of Customer Personal Data" - Google Cloud's Data Processing Addendum, which covers EU GDPR, applies to Google Cloud / Vertex AI services including generative AI.”
Verify on cloud.google.com“"The Google Cloud BAA covers Google Cloud's entire infrastructure ... and the following products" - the covered-products list explicitly includes "Generative AI on Gemini Enterprise Agent Platform", which is Google's current name for the Generative AI on Vertex AI product hosting Veo. "Vertex AI" as a bare product name no longer appears since the platform rebrand.”
Verify on cloud.google.com“Google announced: "Google Cloud's commitment to responsible AI is now ISO/IEC certified" for its AI management system; Google separately worked with Coalfire to assess the Vertex AI platform (which hosts Generative AI on Vertex AI, including Veo) against ISO/IEC 42001. Scope is the Google Cloud AI management system, not a Veo-specific certificate.”
Verify on cloud.google.com“"Generative AI on Vertex AI, our secure enterprise platform for hosting the Gemini family of models, is now FedRAMP High authorized, thereby empowering federal agencies to use AI capabilities for their needs." (dated March 21, 2025). Veo is documented as part of this same Generative AI on Vertex AI product surface.”
Verify on cloud.google.com“"Google Cloud has achieved the third-party assessment-based certification (CSA STAR Level 2: Attestation) for Google Cloud and Google Workspace, resulting in a CSA Star SOC2+ report." This is an organization-wide Google Cloud attestation covering the infrastructure Veo runs on via Vertex AI, not a Veo-specific listing.”
> Show 2 unconfirmed / not-held certifications
source: cloud.google.comISO 27701 is part of Google Cloud's overall certification program (cloud.google.com/security/compliance/iso-27701) but was not confirmed as a checked column for the 'Generative AI on Vertex AI' row specifically on the services-in-scope page; only ISO 27001/27017/27018 and SOC 1/2/3 were confirmed for that row. Treat as organization-level, not confirmed product-specific.
source: cloud.google.comOn Google's services-in-scope matrix, the general 'Vertex AI Platform' row is checked for PCI DSS, but the specific 'Generative AI on Vertex AI' row (which hosts Veo) was not confirmed as checked for PCI DSS. No PCI DSS claim should be made for Veo specifically until confirmed against the live table.
// Privacy & AI training
Trains on customer data
Not stated
Data processing agreement
Offered
Data region
No Veo-specific regional residency was documented for the consumer surfaces (Google Flow / Gemini app). The enterprise Generative AI on Vertex AI platform (which hosts Veo for API/enterprise customers) inherits Google Cloud's regional data residency options, per Google's generative AI data residency guarantees for data stored at rest.
Training posture is tier-dependent and could not be fully pinned down for Veo specifically. Enterprise/API tier (Gemini API paid usage, Generative AI on Vertex AI): Google states "Your data is never used to train public models when using Vertex AI" and that the paid Gemini API does not use prompts or responses to improve products; prompts/responses are logged only briefly for safety/abuse/legal compliance. Unpaid Gemini API / Google AI Studio tier: Google states it "uses the content you submit ... and any generated responses to provide, improve, and develop Google products and services and machine learning technologies" - i.e. trains by default. Consumer creative surface (Google Flow, where most people actually generate Veo videos): Google's own Flow privacy notice states that when "Help improve Google Flow" is on, "Google may use your Google Flow interactions, uploads, generated output, related feature usage information, and your feedback to provide, improve, and develop Google products and services and machine learning technologies," with human reviewers seeing a disconnected sample. Google's public Flow help page does not state whether this setting defaults on or off, so this could not be confirmed either way and should not be assumed.
// Security controls
Encryption in transit
Standard Google infrastructure TLS/HTTPS across consumer web apps, the Gemini API, and Vertex AI endpoints; no Veo-specific page publishes separate detail.
cloud.google.comContent watermarking
Every Veo output is marked with SynthID, Google DeepMind's invisible watermarking technology, to help identify AI-generated video and reduce misinformation/misattribution risk.
cloud.google.comSafety filtering / responsible AI review
Veo outputs undergo safety evaluations and checks for memorized content before release; Google states it blocks harmful requests/results and tests new features for safety impact ahead of launch.
docs.cloud.google.comHuman review (consumer tier)
On Google Flow, a sample of uploads and generated output may be read/annotated by human reviewers when "Help improve Google Flow" is on; Google states uploads and outputs are disconnected from the account before reviewers see them, and advises users not to submit confidential information.
support.google.comEnterprise data governance
"We do not use customer data to train our models, in accordance with Google Cloud's built-in data governance and privacy controls. Your customer data is only processed according to your instructions" - applies to Veo and Imagen usage via Vertex AI.
cloud.google.com// Products & data scope
data: Google's global consumer infrastructure; no customer-selectable data region documented
Paid Google AI Pro/Ultra feature. No DPA or BAA for consumer use. Uploads and generated output may be used to improve Google products when "Help improve Google Flow" is on; default state not confirmed from public documentation. Subject to human review of a disconnected sample.
data: Google's global consumer infrastructure; no customer-selectable data region documented
Same general consumer data-handling posture as the broader Gemini app: activity used to improve/train models unless the user disables activity retention; not intended for confidential or regulated data.
data: Google global infrastructure
Google states content submitted and responses generated on unpaid usage are used to provide, improve, and develop Google products and ML technologies - i.e. trains by default. Not suitable for sensitive data.
data: Regional options inherited from Google Cloud's generative AI data residency program
Covered by Google Cloud's compliance program for the 'Generative AI on Vertex AI' service: SOC 1/2/3, ISO 27001/27017/27018, ISO 42001, HIPAA (BAA available), FedRAMP High, and CSA STAR Level 2 per Google's own compliance pages. Google states it does not train on customer prompts/responses/data on this tier; prompts are logged briefly only for safety/abuse/legal purposes.
// What to watch
- TIER-DEPENDENT COMPLIANCE AND TRAINING: Veo spans very different postures depending on entry point. The enterprise/API surface (Generative AI on Vertex AI) carries Google Cloud's certification program and does not train on customer data. The consumer surfaces (Google Flow, Gemini app) have a materially different, less certified posture and may use uploads/outputs to improve products; AIFOXX listings should not present the enterprise certifications as covering the consumer Google Flow experience most users will actually try.
- CERTIFICATION SCOPE INFERRED, NOT VEO-NAMED: None of the certifications reviewed name "Veo" explicitly; they name the umbrella product "Generative AI on Vertex AI" / "Generative AI on Gemini Enterprise Agent Platform," which Google's own documentation confirms hosts Veo (docs live at vertex-ai/generative-ai/docs/models/veo/...). This is a reasonable, sourced inference but is one level removed from a Veo-specific attestation, hence confidence is medium rather than high.
- UNOFFICIAL THIRD-PARTY "VEO" SITES EXIST: Search results surfaced unaffiliated third-party sites using "Veo" branding (e.g. veo3-1.me, www-veo3.com, googleveo.video) that are not Google properties. AIFOXX should link only to deepmind.google, cloud.google.com, ai.google.dev, or labs.google (Flow) as the official Veo destinations and avoid conflating these lookalike sites with Google's product.
- CONSUMER DEFAULT SETTING UNCONFIRMED: Google's own Flow help page describes the "Help improve Google Flow" data-use toggle but does not state whether it is on or off by default; this could not be verified and should not be assumed either way in listing copy.
// At a glance
Pricing model
Consumer: bundled into Google AI Pro/Ultra subscriptions (Google Flow, Gemini app). Developer/enterprise: usage-based pricing via the Gemini API and Vertex AI.
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Google LLC's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-07-09. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
cloud.google.com