Loading the catalogue…
googleUnited States
Google's own Gemini API for the Gemini and Gemma model families, run by Google LLC on Google's global infrastructure. The tier Stav uses does not let the customer choose where requests are served.
Operated by Google · first-partyai.google ↗
Compliance posture · Stav's assessment
Jurisdiction
US · United States
Data residency
GLOBAL
CLOUD Act / FISA 702
Exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Poor
Legal exposure
Poor
Serving retention
Poor
Security posture
Weak
Contractual posture
Adequate
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 5 risk items · 4 safeguards · 1 privacy-policy issue · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 17 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L0Third-country operatorIndicativeregistry 4.1
This level applies to traffic routed through Stav.
Google is at L0. L1 is blocked because Stav has not confirmed that customer data and serving infrastructure stay in the EU, and Google LLC is subject to US law.
3 criteria from L1: Customer data in the Union, Infrastructure in the Union, No coerced vulnerability silence.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 17 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO 27001
Information security management for Google Cloud and Google Workspace services. · Claimed by the provider · verified 17 Oct 2026
ISO 27017
Cloud security controls for Google Cloud and Google Workspace services. · Claimed by the provider · verified 17 Oct 2026
ISO 27018
Protection of personal data in public cloud for Google Cloud and Google Workspace. · Claimed by the provider · verified 17 Oct 2026
ISO 27701
Privacy information management as a PII processor for Google Cloud and Google Workspace. · Claimed by the provider · verified 17 Oct 2026
ISO 42001
AI management system for Google Cloud, Google Workspace and the Gemini app. · Claimed by the provider · verified 17 Oct 2026
SOC 1 Type II
Controls relevant to financial reporting for Google Cloud and Google Workspace. · Claimed by the provider · verified 17 Oct 2026
SOC 2 Type II
Trust Services Criteria controls for Google Cloud and Google Workspace, reported quarterly. · Claimed by the provider · verified 17 Oct 2026
SOC 3
Public summary of the SOC 2 audit for Google Cloud and Google Workspace. · Claimed by the provider · verified 17 Oct 2026
BSI C5
C5:2020 attestation for Google Cloud and Google Workspace. · Claimed by the provider · verified 17 Oct 2026
FedRAMP (Moderate and High)
US federal authorizations for Google Cloud and Google Workspace products. · Claimed by the provider · verified 17 Oct 2026
CSA STAR
Level 2 attestation for Google Cloud. Level 2 certification covers Dammam and Doha regions only. · Current · verified 17 Oct 2026
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 11 certification sources
Compiled by Stav from the provider's published documentation. Last verified 17 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 18
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| Gemini 4 Argon | €1.76 | €8.80 | — | — |
| Gemini 3.8 Flash Lite TTS | €0.44 | €5.28 | — | — |
| Gemini 3.8 Flash TTS | €0.44 | €7.92 | — | — |
| Gemini 3.8 Flash | €0.66 | €3.30 | 3.88 s | 5041 |
| Gemini 3.5 Flash Lite | €0.26 | €2.20 | 0.50 s | 737 |
| Gemini 3.6 Flash | €0.66 | €3.30 | 1.55 s | 5148 |
| Gemini 3.1 Flash Lite | €0.22 | €1.32 | 1.74 s | 506 |
| Gemini Embedding 2 | €0.18 | Free | — | — |
| Gemma 4 26B A4B IT | Free | Free | 0.71 s | 31 |
| Gemma 4 31B IT | Free | Free | 0.99 s | 14 |
| Gemini 3.1 Flash TTS Preview | €0.88 | €17.60 | — | — |
| Gemini 3.1 Pro Preview | €1.76 | €10.56 | 10.60 s | 2088 |
| Gemini 3 Flash Preview | €0.44 | €2.64 | 1.04 s | 699 |
| Gemini 2.5 Flash-Lite | €0.09 | €0.35 | 0.61 s | 279 |
| Gemini 2.5 Pro | €1.10 | €8.80 | 1.78 s | 3 |
| Gemini 2.5 Flash | €0.26 | €2.20 | 0.88 s | 461 |
| Gemini 2.5 Flash Preview TTS | €0.44 | €8.80 | — | — |
| Gemini 2.5 Pro Preview TTS | €0.88 | €17.60 | — | — |