Skip to content
Sec-Gemini docs

Privacy & Data Protection

Sec-Gemini is engineered with privacy and data protection as core architectural guarantees. This page details how user prompts and analysis results are handled, tenant isolation boundaries, voluntary unlisted sharing capabilities, automated data deletion retention schedules, account controls, and governing terms of service.

Prompt & Result Confidentiality

Section titled “Prompt & Result Confidentiality”

All prompts, code snippets, execution parameters, reasoning chains, tool outputs, and analysis results processed by Sec-Gemini are strictly confidential to your account.

  • Account & Tenant Isolation: All session data, stored states, and analytical artifacts are logically segregated by account identity. No other account or unauthorized external party can access or view your prompts or results.
  • No Third-Party Sharing: Google does not share your sessions, prompts, or results with third parties.
  • No Model Training: Your prompts, code, tool inputs, and analysis results are not used to train AI models.
  • Trusted Tester Agreement: If you participate as a trusted tester, confidentiality is also governed by your Trusted Tester Agreement, which may allow Google to process your sessions for system reliability, debugging, and service improvements.
  • End-to-End Encryption: All data is encrypted in transit using TLS 1.3 and gRPC transport security, and encrypted at rest using standard Google Cloud AES-256 encryption.

Optional & Voluntary Unlisted Sharing

Section titled “Optional & Voluntary Unlisted Sharing”

By default, every session and its associated prompts, reasoning steps, and results are strictly private to the account holder. However, Sec-Gemini provides an optional collaboration capability through unlisted sharing:

  • Voluntary & Opt-In: Unlisted sharing is completely voluntary and disabled by default. A session becomes shared only when you explicitly opt to generate an unlisted share link.
  • Unlisted Link Access: When unlisted sharing is enabled, anyone with the direct, unique unlisted link can access and view the shared session contents and results.
  • Search & Directory Exclusion: Unlisted sessions are excluded from public search engine indexing and do not appear in public directories or account listings.
  • User Permission Control: Account owners retain full control over shared sessions and can modify or revoke unlisted sharing access at any time.

Automatic Data Deletion

Section titled “Automatic Data Deletion”

Sec-Gemini enforces strict, automated data retention limits and expiration schedules across all cloud storage layers to minimize data footprint and enforce privacy guarantees.

As detailed in the High-Level Architecture & Security documentation, system data is automatically deleted according to the following retention schedules:

  • Firestore Job Records & Snapshots: Ephemeral state snapshots and job execution metadata are automatically expired and permanently deleted after 7 days from creation.
  • Uploaded Files & Artifacts: Target samples, uploaded files, and generated output artifacts are automatically expired and permanently deleted after 7 days.
  • Google Cloud Logging Retention: Diagnostic logs stored in Google Cloud Logging are retained for 30 days, after which they are permanently purged. For sessions executed with logging disabled (--disable-logging or never_log API key policy), no session logs are written to Cloud Logging, other than critical exceptions (which are sanitized of user data).

For additional architecture details on logging suppression and ephemeral state management, refer to the Architecture & Security Guide.

Account Deletion & Data Download

Section titled “Account Deletion & Data Download”

Account Deletion

Section titled “Account Deletion”

Users can delete their Sec-Gemini account at any time via the settings page. Account deletion immediately purges your user profile, active API keys, and associated session configurations from the platform.

Exporting and Downloading Data

Section titled “Exporting and Downloading Data”

You can download and export your complete session history, prompts, tool execution logs, and output results programmatically at any time through the Sec-Gemini API (using the Python SDK or gRPC API endpoints).

Terms of Service & Legal References

Section titled “Terms of Service & Legal References”

Sec-Gemini services and data handling practices are governed by Google’s Terms of Service and API policies. For full legal and compliance details, please refer to: