AI tools and client data

Is Google Gemini safe for client data?

Short answer: Whether Google Gemini is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself. On Gemini Apps on a personal Google Account, Google says it uses what staff type to improve its services, with human review, and we did not find a plain statement about model training; on Gemini for Google Workspace (work account), Google says it does not train its models on what staff type, by default. Every fact on this page is Google's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap. Obsidian Ridge's free 30-day AI security assessment shows which AI tools your staff actually use.

By Kfir Yair, CISSP. Published . Updated .

See which AI tools your staff use

Plan by plan, in Google’s own words

Google's assistant, in the Gemini app and in the side panel of Gmail, Docs and Drive — and the same person may use both a personal one and a work one.

What you are askingGemini Apps on a personal Google AccountGemini for Google Workspace (work account)
Trains the vendor's models by defaultSome conversations are read by people, and Google says that is part of how it improves the service.“Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes.” source, read No. Google says Workspace content is not reviewed by people or used for training outside your own domain without permission.“Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission.” source, read
How to turn training offTurning Keep Activity off narrows it but does not stop everything: Google says reviewers may still be involved.“Even if your Keep Activity setting is off, Google still uses your chats … including with help from human reviewers.” source, read Not found in the pages we read.
How long data is keptA chat a reviewer has seen outlives your deletion by up to three years. This is the sentence to read twice.“Chats reviewed by human reviewers … are not deleted when you delete your activity. Instead, they are retained for up to three years.” source, read Your admin sets it, from 90 days to indefinite in Workspace, and the Gemini app defaults to 18 months.“Prompts and responses | 90 days to indefinite, as determined by admins” source, read
What an admin can see or controlNot found in the pages we read.An admin can set automatic deletion and decide whether staff may delete conversations themselves.“Admins can choose to automatically delete conversations after 3, 18, or 36 months. The default is 18 months.” source, read
Single sign-onNot found in the pages we read.The Workspace account carries Gemini, so the identity provider you already run covers it.“Google Workspace supports both SAML-based and OIDC-based SSO.” source, read
Business Associate AgreementNot found in the pages we read.Google signs a BAA for Workspace, but only for the services on its HIPAA Included Functionality list, which this page does not reproduce.“Google Workspace and Cloud Identity customers who are subject to HIPAA … must enter a Business Associate Amendment (BAA) with Google.” source, read
Where the data is processedNot found in the pages we read.Not found in the pages we read.

An empty cell is not a reassurance and not a criticism. "Not found in the pages we read." means the Google pages listed under Sources, read on the dates shown, do not answer it — so there is nothing for us to repeat, and something for you to ask Google before client information goes near it.

What this means for

The duty does not change because the tool is new. What changes is where the client information ends up.

  • Law firms. A client confidence pasted into a personal account has left the firm’s control. Our law firm page sets out the duties we build evidence for; the decision here is whether a personal account may touch a client matter at all.
  • Dental and medical practices. Google publishes a BAA position for this product, which is where that conversation starts. See dental practices.
  • CPA and accounting firms. Your written information security plan has to describe the tools people actually use, not the ones you approved. See accounting firms.
  • Financial advisers. Client account data in a personal assistant is the exposure; see financial advisers.
  • Software teams. A coding assistant reads the repository and can run commands, so the question is what it can reach, not what it was asked. See what AI agents on work laptops can reach.

How to tell which version your staff use

The plan is the whole answer, and you cannot tell from the outside. Three ways to find out, in order of how much they prove.

  1. 1. Ask

    Quick, free, and incomplete. People forget the tool they installed once and the account they signed in with.

  2. 2. Look at the billing and the admin console

    This finds what the business pays for. It does not find a personal account, which is the one that matters here.

  3. 3. Look on the computers

    A tool somebody installed themselves never appears in an IT list. Obsidian Ridge’s free 30-day AI security assessment takes a quiet inventory for 30 days and shows what each tool could reach, then a CISSP goes through it with you. See the assessment, or read a sample set of findings.

Settings to check today

From Google’s own documentation. Each one is a change somebody can make this afternoon.

  • On a work account, set the Gemini conversation retention period rather than leaving the 18-month default.“Admins can choose to automatically delete conversations after 3, 18, or 36 months. The default is 18 months.” source, read
  • Keep client files out of a personal Gemini. Google's own control does not cover reviewed chats.“Your Gemini settings don't control processing of your chats to create anonymized data to improve Google services.” source, read
  • Use your existing access controls: Gemini only reaches what the person can already open.“If the user doesn't have access to a document or email, Gemini will not retrieve that content.” source, read

Worth knowing

  • The retention an admin inherits is 18 months, not off, which is worth knowing before anyone assumes conversations go away.“Admins can choose to automatically delete conversations after 3, 18, or 36 months. The default is 18 months.” source, read
  • Gemini Notebook sits outside the Workspace controls an admin may think cover everything.“Your organization's file sharing and data region settings do not apply to data in Gemini Notebook.” source, read

Questions we get asked

Is Google Gemini safe for client data?

Whether Google Gemini is safe for client data turns on which plan your staff are on, which account they signed in with, and what you have told them they may put in it — not on the product itself.

On Gemini Apps on a personal Google Account, Google says it uses what staff type to improve its services, with human review, and we did not find a plain statement about model training; on Gemini for Google Workspace (work account), Google says it does not train its models on what staff type, by default.

Every fact on this page is Google's own, quoted from its own pages and dated, and where we did not find a statement this page says so rather than filling the gap.

Does Google train its models on what our staff type into Google Gemini?

On Gemini Apps on a personal Google Account, Google says it uses what staff type to improve its services, with human review, and we did not find a plain statement about model training; on Gemini for Google Workspace (work account), Google says it does not train its models on what staff type, by default.

On Gemini Apps on a personal Google Account: Some conversations are read by people, and Google says that is part of how it improves the service.

Google's own words: "Human reviewers (including trained reviewers from our service providers) review some of the data we collect for these purposes." (read 2026-11-02).

On Gemini for Google Workspace (work account): No. Google says Workspace content is not reviewed by people or used for training outside your own domain without permission.

Google's own words: "Your content is not human reviewed or otherwise used for Generative AI model training outside your domain without permission." (read 2026-11-02).

How long does Google keep what we put into Google Gemini?

On Gemini Apps on a personal Google Account: A chat a reviewer has seen outlives your deletion by up to three years. This is the sentence to read twice.

Google's own words: "Chats reviewed by human reviewers … are not deleted when you delete your activity. Instead, they are retained for up to three years." (read 2026-11-02).

On Gemini for Google Workspace (work account): Your admin sets it, from 90 days to indefinite in Workspace, and the Gemini app defaults to 18 months.

Google's own words: "Prompts and responses | 90 days to indefinite, as determined by admins" (read 2026-11-02).

Can an administrator read what our staff typed into Google Gemini?

An admin can set automatic deletion and decide whether staff may delete conversations themselves. Google's own words: "Admins can choose to automatically delete conversations after 3, 18, or 36 months. The default is 18 months." (read 2026-11-02).

Will Google sign a Business Associate Agreement for Google Gemini?

Google signs a BAA for Workspace, but only for the services on its HIPAA Included Functionality list, which this page does not reproduce.

Google's own words: "Google Workspace and Cloud Identity customers who are subject to HIPAA … must enter a Business Associate Amendment (BAA) with Google." (read 2026-11-02).

A signed BAA is between your practice and Google; we do not sign it for you, and we do not read a compliance badge as one.

How do we find out which version of Google Gemini our staff are using?

Look on the computers. A tool somebody installed themselves, or signed into with a personal account, does not appear in any IT list. Obsidian Ridge's free 30-day AI security assessment takes that inventory for 30 days and shows what each tool could reach.

Sources

Google’s own pages, with the date each was read. Nothing on this page comes from anywhere else.

All 15 tools, side by side, or run the AI tool risk checker over the ones you know about.

Other tools people ask about

Same question, different answers. The ones in the same category are the ones staff swap between.