This is what the current product and terms support: the access we request, where lake data lives, how product access is limited, and what the exit path looks like.
If a control has not been verified, we do not claim it here.
Current terms limit data-warehouse and cloud-account access to specific systems agreed for the service, only to retrieve the data needed to provide it.
Several connectors request vendor read-only scopes. Some vendors bundle broader permissions, so each connection's actual scope needs its own review.
Managed lake tables use Apache Iceberg in Google Cloud Storage. Table data is stored in Parquet, and analytics project assets live in Git.
That makes handoff a matter of standard files, table metadata, and versioned project assets — not a proprietary export.
Google Cloud encrypts stored customer content by default. The lake calls Google Cloud Storage over HTTPS, and the public product is served through an HTTPS gateway.
We describe a lake as using customer-managed encryption keys only after checking its bucket. This page does not make a blanket CMEK claim.
The default production backend keeps connector secrets in Google Secret Manager. Every secret read and write names the organization that owns it; an ownership mismatch is refused.
The access layer provides organization checks for apps, configurations, and lakes. Those checks refuse lookups outside the organization.
The job system stores the organization, status, and timing for query work. A separate durable audit log covers user and organization changes.
We do not describe that as a record of every read, because it is not one.
Our Privacy Policy says we do not sell customer lists. It also explains that service providers may process information needed to provide the service.
Calling that “never shared” would be inaccurate, so we do not say it.
Current terms say account content will be returned on written request within at most 30 days after closure or termination, in a mutually agreed format. They also allow some account information to be retained when permitted or required by law.
Engagement length, any model-use limits, and deletion steps belong in signed paperwork. This page does not replace it.