Apps for EducationLearn more:
A technology platform schools can trust
Our business is built on your trust. We recognize that schools expect us to properly secure their data and respect the privacy of their information.
We therefore take data security and privacy very seriously. Google Apps is designed to provide your educational institutions with a safe, reliable platform for its data -- offering better security and reliability than most schools could achieve on their own.
Google Apps is also governed by a detailed Privacy Policy, which ensures we will not inappropriately share or use personal information placed in our systems.
Students are thrilled, and we feel comfortable that security and privacy issues have been met.
– Wendy Woodward, Director of Technology Support Services, Northwestern University
- The Google Apps Terms of Service contractually ensures that your institution (or students, faculty, and staff) are the sole owners of their data.
- Because customers own the data they put into Google Apps, we believe it should be easy for your users to move their data in and out of our systems.
- The controls, processes and policies that protect user data in our systems have obtained a SSAE 16 Type II attestation and will continue to seek similar attestation.
- Google complies with applicable US privacy law, and the Google Apps Terms of Service can specifically detail our obligations and compliance with FERPA (Family Educational Rights and Privacy Act) regulations.
- Google is registered with the US-EU Safe Harbor agreement, which helps ensure that our data protection compliance meets European Union standards for educational institutions.
No advertising to students, faculty, or staff
We offer Google Apps for Education to schools for free. It's also completely ad-free -- which means your school's content is not processed by Google's advertising systems.
Better protection for your school's domain
Google operates one of the most robust networks of distributed datacenters in the world. The protection of the intellectual property on these servers is critically important to us -- in fact, employees at Google, Inc. rely upon the same Apps production environment used by our education customers.
Google Apps brings you the latest technologies and some of the best practices in the industry for network application security and user privacy, as summarized below.
Google's privacy policy protects your users:
- It's your content, not ours. Your Apps content belongs to your school, or individual users at your school. Not Google.
- We don't look at your content. Google employees will only access content that you store on Apps when an administrator from your domain grants Google employees explicit permission to do so for troubleshooting.
- We don't share your content. Google does not share personal information with advertisers or other 3rd parties without your consent.
- We sometimes scan content. And for very good reasons, like spam filtering, anti-virus protection, or malware detection. Our systems scan content to make Apps work better for users, enabling unique functionality like powerful search in Gmail and Google Docs. This is completely automated and involves no humans.
Note that there are a few common-sense exceptions to the points above, like valid legal processes and maintaining the safety and security of our systems. For more information, see our detailed Privacy Policy, Privacy Principles, and Terms of Service.
Google's security resources help protect your data:
- People – Google employs a full-time information security team including some of the world's foremost experts in information, application, and network security. This team is responsible for the company's perimeter defense systems, security review processes, and customized security infrastructure, as well as for developing, documenting, and implementing Google's security policies and standards.
-
We looked long and hard and analyzed in much detail the security that Google offered in this space and at the end of the day, a world class security team from Motorola came back and said this is ready to go.
– Walt Oswald, VP of IT, Motorola Mobile Devices
- Process – Security is part of Google's DNA, and core to our design and development process. Google applications go through security reviews as part of the Secure Code development process. The application development environment is closely restricted and carefully monitored to maximize security. External security audits are also regularly conducted to provide additional assurance.
- Technology – To reduce exploit risks, each Google server is custom-built with only the necessary software components, and the homogeneous server architecture enables rapid updates and configuration changes across the entire network when necessary. Data is replicated in multiple data centers for redundancy and consistent availability.
Additional security and privacy features can also be found in the Apps products themselves, such as Gmail's exceptional spam and virus filters; default https (encrypted) access to Apps services, blocked transmission of EXE files, and more.
Additional safeguards for research and teaching staff
As an add-on to Google Apps, Postini services can help your school further safeguard information and meet security and compliance requirements. Message security tools enable your administrators to create a variety of policies and filters for your school's email (beyond the strong spam and virus filtering in Gmail), while mail archiving and discovery tools allow schools to retain emails in a centralized, searchable repository for up to 10 years.
Security FAQs
Who owns the data that organizations put into Google Apps?
To put it simply, Google does not own your data. We do not take a position on whether the data belongs to the institution signing up for Apps, or the individual user (that's between the two of you), but we know it doesn't belong to us!
The data you put into our systems is yours, and we believe it should stay that way. We think that means three key things.
- We won't share your data with others except as noted in our Privacy Policy.
- We keep your data as long as you require us to keep it.
- Finally, you should be able to take your data with you if you choose to use external services in conjunction with Google Apps or stop using our services altogether.
Where is my organization's data stored?
Your data will be stored in Google's network of data centers. Google maintains a number of geographically distributed data centers, the locations of which are kept discreet for security purposes. Google's computing clusters are designed with resiliency and redundancy in mind, eliminating any single point of failure and minimizing the impact of common equipment failures and environmental risks.
Access to data centers is very limited to only authorized select Google employees personnel.
Is my organizations data safe from your other customers when it is running on the same servers?
Yes. Data is virtually protected as if it were on its own server. Unauthorized parties cannot access your data. Your competitors cannot access your data, and vice versa. In fact, all user accounts are protected via this virtual lock and key that ensures that one user cannot see another user's data. This is similar to how customer data is segmented in other shared infrastructures such as online banking applications.
Google Apps has received a satisfactory SSAE 16 Type II audit. This means that an independent auditor has examined the controls protecting the data in Google Apps (including logical security, privacy, Data Center security, etc) and provided reasonable assurance that these controls are in place and operating effectively.
What does a Google Apps SSAE 16 Type II audit mean to me?
An independent third party auditor issued Google Apps an unqualified SSAE 16 Type II attestation. Google is proud to provide Google Apps administrators the peace of mind knowing that their data is secure under the SSAE 16 auditing industry standard.
The independent third party auditor verified that Google Apps has the following controls and protocols in place.
- Logical security: Controls provide reasonable assurance that logical access to Google Apps production systems and data is restricted to authorized individuals
- Privacy: Controls provide reasonable assurance that Google has implemented policies and procedures addressing the privacy of customer data related to Google Apps
- Data center physical security: Controls provide reasonable assurance that data centers that house Google Apps data and corporate offices are protected
- Incident management and availability: Controls provide reasonable assurance that Google Apps systems are redundant and incidents are properly reported, responded to, and recorded
- Change management: Controls provide reasonable assurance that development of and changes to Google Apps undergo testing and independent code review prior to release into production
- Organization and administration: Controls provide reasonable assurance that management provides the infrastructure and mechanisms to track and communicate initiatives within the company that impact Google Apps
Can my organization use our own authentication system to provide user access to Google Apps?
Google Apps integrates with standard web single sign-on systems using the SAML 2.0 standard. Organizations can do the integration themselves, or work with a Google partner to accomplish this.
Visit our Help Center for more Security and Privacy FAQs.
