We re-check published residency, subprocessor and certification pages and log every change. One email when something we track changes — nothing else.
Email only. Unsubscribe in one click from any email. We never share the list with vendors.
“When you store data on Agent Platform (such as custom model weights or metadata), it remains physically stored in the specific Google Cloud location you chose.”docs.cloud.google.com
“When you use jurisdictional endpoints, ML processing stays within that specific geographical region (such as the United States or the European Union).”docs.cloud.google.com
“Gemini doesn't use your prompts or its responses as data to train its models.”docs.cloud.google.com
“Google and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the Google Cloud Platform Services.”cloud.google.com
“ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3”cloud.google.com
“Google Australia Pty Ltd.”cloud.google.com
“When you store data on Agent Platform (such as custom model weights or metadata), it remains physically stored in the specific Google Cloud location you chose.”docs.cloud.google.com
Answered only from what the vendor publishes on its own public pages, as at the check date shown. Not an assessment, audit, certification or endorsement.
“When you use jurisdictional endpoints, ML processing stays within that specific geographical region (such as the United States or the European Union).”docs.cloud.google.com
Answered only from what the vendor publishes on its own public pages, as at the check date shown. Not an assessment, audit, certification or endorsement.
“Gemini doesn't use your prompts or its responses as data to train its models.”docs.cloud.google.com
Answered only from what the vendor publishes on its own public pages, as at the check date shown. Not an assessment, audit, certification or endorsement.
“ISO/IEC 27001 | ISO/IEC 27017 | ISO/IEC 27018 | ISO/IEC 27701 | ISO/IEC 42001 | PCI 3DS Core Security Standard | PCI DSS | PCI PIN Security | SOC 1 | SOC 2 | SOC 3”cloud.google.com
Answered only from what the vendor publishes on its own public pages, as at the check date shown. Not an assessment, audit, certification or endorsement.
The public tracker stays free — it always will. For organisations that need more, we’re building a professional tier: monitoring of your vendor list, change alerts with the evidence attached, audit-ready packs formatted for privacy impact assessments and automated-decision disclosures, and a quarterly analyst briefing.
From December 2026, the Privacy Act requires organisations to disclose automated decision-making in their privacy policies (Privacy and Other Legislation Amendment Act 2024, ADM transparency provisions) — which means knowing, on an ongoing basis, exactly what your AI vendors run and where. That’s what this register is for.
Founding membership is limited to the first 20 organisations and locks founding pricing permanently. Register interest now — founding members get first access and shape what we build.
Registering interest is not a purchase or commitment. The free public tracker is unchanged.
Are we missing something, or has this changed? Vendors and their representatives can submit a correction and we will update the entry, note the change and credit the source. Corrections are typically actioned within 2 business days.
Submit a correction