AI Builds: How Secure is Google?

Your clients' bank statements, tax returns, and credit reports may already live on Google's servers. Gmail, Drive, Docs, and now Gemini. Google probably protects that data better than the server in your closet ever could. But Google securing its infrastructure doesn't mean your client's information is secure. If Google is doing its job perfectly, who's responsible when client data still gets out?

**In this episode:**

- The four separate security worries lawyers lump together: outside hackers, Google employees, AI model training, and your own firm handing out access
- Why Google's infrastructure likely beats the typical small-firm setup of a closet server, an on-call IT consultant, and an untested backup
- Google's shared responsibility model: Google secures the platform, and the firm controls who and what gets in
- How a mis-shared folder, a compromised account, or an over-permissioned app exposes client data while Google's systems work perfectly
- Limited-scope authorization and the drive.file permission, which give an AI app one matter's files instead of the whole filing cabinet
- Three Gemini environments with different data terms: consumer Gemini, Gemini under Workspace business terms, and Vertex AI
- Why "doesn't train on your data" is not the same as "doesn't retain your data," including abuse monitoring, caching, and 30-day grounding retention
- What a security readiness review of Ron's own AI bankruptcy platform revealed, and why the answer to "ready for real client data?" was no
- Four failures Google's infrastructure can't fix: one firm seeing another firm's files, a departed paralegal who still has access, temporary copies never deleted, and no incident response plan
- Five things lawyers should do now: know your account, require strong sign-in, check third-party permissions, question AI vendors, and treat security as ongoing

**We also discuss:**

- Why having a Gmail address doesn't put you under Workspace business protections
- Consumer Gemini configurations where humans may review your conversations
- Why zero data retention on Vertex AI takes affirmative configuration choices
- Passkeys and security keys as phishing-resistant sign-in, even though multi-factor authentication is a pain
- The questions every AI vendor should be ready to answer, including what happens to your documents when you cancel

> Download: AI Builds — How Secure Is Google? (Three-Legged Stool Visual Guide)
> A six-page, click-by-click guide to Google's admin console for locking down client data, organized around Ron's three-legged stool: Google's security, the application's security, and the firm's own practices.
> - Requiring 2-Step Verification and passkeys across the firm
> - Controlling who in the firm can use the Gemini app
> - Reviewing which third-party apps hold OAuth access to firm data, and how much
> - Setting external Drive sharing boundaries and Gemini conversation retention

**Key Takeaway**

Google can protect the vault. It can't stop you from handing someone the key. Ron's own platform had good safeguards on paper. It had limited Drive access, firm isolation, and an audit trail, and it still wasn't ready for real client data, because designing protections and proving they work are two different things. The question isn't whether Google is secure. It's whether every link in the chain touching your client's information is secure.

For Users, the work is unglamorous. Know which account you're signed into, turn on strong sign-in, and read what an app is asking for before you click Allow. For Builders, the bar is higher: test firm isolation, offboarding, deletion, and incident response before the first real client file arrives. And expect lawyers to start asking how you tested those protections.

**Mentioned in This Episode**

- Google Workspace (Gmail, Google Drive, Google Docs)
- Gemini (consumer)
- Gemini in Google Workspace business accounts
- Google Vertex AI
- Google's shared responsibility model (Google Cloud documentation)
- Google's drive.file limited-scope permission
- Google Workspace privacy documentation and Vertex AI enterprise terms
- Passkeys and security keys
- Ron's AI-assisted consumer bankruptcy platform and its internal security readiness review

Google Workspace Generative AI Privacy Hub — Google's commitments concerning training, confidentiality, human review, and Workspace data.

Google Cloud: Vertex AI and Zero Data Retention — Training restrictions, caching, retention exceptions, and configuration requirements.

Google: Choose Google Drive API Scopes — Explains how developers can limit an application's access to individual files.

Google Cloud Shared Responsibility — Explains what Google secures and what customers remain responsible for.

Google: Turn the Gemini App On or Off — Explains the differences in protection between qualifying Workspace accounts and other configurations.

Highlight Reels on YouTube and Instagram

> [email protected]