Google Vertex AI subprocessor review for SaaS customer commitments
For Vertex AI, subprocessor review should use Google Cloud's subprocessor source and the Google Cloud DPA. A SaaS team should confirm whether its customer-facing vendor list names Google Cloud correctly and whether any stored prompts, outputs, or logs introduce additional subprocessors outside Google.
Vendor
Google Vertex AI / Gemini for Cloud
Issue
subprocessors
Sources reviewed
3 official sources
Product and plan applicability
- Scope
- Google Cloud services
- Applies to
- Vertex AI, Cloud Logging, storage, analytics, and related Google Cloud resources.
- Watch for
- Google Cloud subprocessor updates and any service-specific customer data paths.
- Scope
- Third-party tooling around Vertex AI
- Applies to
- Observability, data warehouse, support, or analytics systems that receive prompts or outputs.
- Watch for
- Additional subprocessors controlled by your company, not Google.
- Scope
- Workspace or consumer Gemini
- Applies to
- Non-Vertex AI Google product use.
- Watch for
- Use the product-specific subprocessor and terms sources for that product.
| Scope | Applies to | Watch for |
|---|---|---|
| Google Cloud services | Vertex AI, Cloud Logging, storage, analytics, and related Google Cloud resources. | Google Cloud subprocessor updates and any service-specific customer data paths. |
| Third-party tooling around Vertex AI | Observability, data warehouse, support, or analytics systems that receive prompts or outputs. | Additional subprocessors controlled by your company, not Google. |
| Workspace or consumer Gemini | Non-Vertex AI Google product use. | Use the product-specific subprocessor and terms sources for that product. |
What official sources say
Google Cloud publishes a subprocessor list
The Google Cloud Platform Subprocessors page is the public source to monitor before updating customer vendor exhibits.
DPA review gives the contract context
The Google Cloud Data Processing Addendum should be reviewed with the subprocessor list before making customer-facing processor or subprocessor statements.
Why a SaaS team should review it
- Customer DPAs often require notice or review when subprocessors change.
- A Vertex AI feature may also touch Cloud Logging, storage, or analytics services that affect your own vendor map.
- Subprocessor evidence gets stale quickly if it is copied once and never rechecked.
Potential customer commitment drift
- Your customer subprocessor list names Google but omits the specific Google Cloud service context.
- Prompts are sent to a third-party observability vendor after Vertex AI processing, and that vendor is missing from the exhibit.
- The Google Cloud subprocessor source changes and customer-facing records are not refreshed.
Review checklist
- Attach the Google Cloud subprocessor source and DPA to the vendor record.
- Check whether any prompts, outputs, files, or logs leave Google Cloud for other tools.
- Update customer subprocessor exhibits only after checking the current source.
- Record which Google Cloud services are in scope for the AI feature.
- Keep Workspace Gemini and Vertex AI subprocessor evidence separate.
Source links
Sources were reviewed on 2026-05-21. This page supports a review packet or monitoring evidence packet; it is not legal advice.
Related pages
Scan Google Vertex AI / Gemini for Cloud against your own commitments.
Use this page as a starting point, then compare the vendor source to the exact promise in your Trust Center, DPA, security questionnaire, or sales answer. The $199 packet turns that review into cited evidence your team can route internally.