Security

What content counts towards your storage quota? What doesn't?

The following files are counted:

1. Google Drive
   • PDFs, images, videos, Meet meeting recordings, and Sites project files.
   • Files created or modified after May 2, 2022, in collaboration apps like Google Docs, Sheets, Slides, Drawings, Forms, Voice Memos, or Jamboard.
   • Content in shared drives.
   • Content in the Trash until it is permanently deleted.
2. Gmail
   • All emails and their attachments, including items in the Spam folder. and Trash.
3. Google Photos
   • Images and videos uploaded to Google Photos at Original quality.
   • Images and videos uploaded to Google Photos at High quality (now called File Compression) and Express quality after June 1, 2021. High and Express quality items uploaded before that date don't take up storage.

The following files aren't counted:

• Drive shortcuts.
• Google Chat messages and attachments.
• Content created in the My Maps app.
• Files shared with users. Shared files only count towards the file owner's quota, not the users they share with.
• Version history for files created in Google Docs, Sheets, and Slides, unless the user has checked the box to keep older versions.

What happens if a user or organization exceeds the storage limit?

1. If a user exceeds the storage limit set by their administrator or license, their use of Google services will be immediately impacted.
   • Uploading or copying files to Google Photos will be unavailable once the limit is reached.
2. If an organization exceeds the limit by 25% or 14 days (whichever comes first):
   • Users will not be able to upload new files or images to Google Drive.
   • Users will not be able to create files in collaboration apps like Google Docs, Sheets, Slides, Drawings, and Forms. Until the storage limit is reduced to the allowed limit, no user will be able to edit or copy affected files or submit forms that they own.
   • Google Meet meeting recording will not be available.
3. Even if the organization's limit is exceeded, users will be able to sign in to their Google Workspace account, send and receive emails, and view and download files.
4. If your quota is exceeded for two or more years, all user content in Gmail, Google Photos, and Google Drive may be deleted. This includes Google Docs, Sheets, Slides, Drawings, Forms, Vids, and Jamboard files.

   Before Google deletes content:

   • Notifies you via email or notifications in Google services at least three months before the content is scheduled to be deleted.
   • Gives you the option to prevent data deletion by purchasing additional storage or freeing up storage.
   • Gives you the option to download data from Google services.

Google Drive Data Security

If you use Google Drive for an organization or school, all files you receive from people outside your organization are scanned for malware and phishing. For your security, access to inappropriate files is blocked. When Google's algorithms classify a file as likely spam, it is blocked or redirected to spam.

Google reserves the right to immediately block a Drive user who violates the Acceptable Use Policy. To prevent fraud and other malicious activity in Google Drive, we use reCAPTCHA. If a violation is detected across an organization or school, Google may block the entire account and block the administrator from accessing all Google Workspace services. In this case, we will send a notification to the primary administrator via a secondary email address.

Files uploaded to Google Drive are stored in secure data centers.

If something happens to your computer, phone, or tablet, you can access your documents from other devices.
By default, files are visible only to you. However, you can share them with other users.

Privacy of data in Google Drive, Docs, Sheets, Slides and Vids

User data is used for personalization

To make it easier for users to use our services, Google processes some customer data while ensuring its protection. You can change your privacy settings at any time in your Google account.

• User content is secure

  When a user uploads or creates files on Google services, they are stored in Google data centers that use security systems that meet all global standards. Data is encrypted when transferred and stored. If you work with files offline, the information is stored on your device.

  Google Account security systems built into your account detect and block threats such as spam, phishing, and malware. Strict data protection standards are applied when storing information about your activities.

• Your name and email address are used to sync data and send you newsletters

  Google stores your name and email address to remember your preferences, make it easy to sign in, provide access to files uploaded from different devices, and notify you about changes to services and user activities.

• User data is needed to create and manage a Google account

  When you create a Google account, you are asked to provide your name and phone number. Later, when you manage your account, you can add additional information, such as your physical address and profile photo, and upload contacts.

• Data from Google Drive, Docs, Sheets, Slides and Vids is used to improve services

  By analyzing the content you save in Google services, you can use features such as spam filtering, virus detection, malware protection, and search for files in your account.

  To improve the performance and reliability of our services, we collect data about their operation and failures. In addition, this data helps prevent service failures and analyze their operation.

• Google Drive content is not used to manage ads

  Google does not use data from apps that store primarily personal content to tailor ads.

Transparent Access: View logs of Google employees' access to users' content

What are Transparent Access Logs?

These logs record information about actions taken by Google employees, including:

• Support actions that were requested by a customer over the phone;
• Simple technical actions during the analysis performed while processing a support request;
• Other technical actions to keep the service running, such as recovering from a failure.

Transparent Access Use Cases

Transparent Access can be useful in a variety of situations. For example, you can use it to:

• make sure that Google only accesses user data for business purposes, such as when resolving an issue or processing a request.
• make sure that Google specialists process the request correctly;
• collect and analyze information about monitored access events using an automated security information and event management (SIEM) tool.

Services that keep transparent access logs

• Gmail: subjects, message texts, attachments.
• Calendar: names, descriptions, and locations of events.
• Chat: names, chat room names, chat groups; message texts and topics in direct messages and chat rooms; information about users, including names, email addresses, and chat room memberships.
• Drive: Contents of source files uploaded to Drive.
• Google Docs, Forms, Sheets, Sites, and Slides: Contents of documents, including text content, inline images and drawings, comments, and responses received through forms.
  Note: The legacy version of Sites is not supported.
• Meet: Recordings stored in Drive.
  Note: Google does not have administrative access to ongoing meetings. Recordings stored in Drive — this is all that remains after the meeting is over.

Transparent Access Logging Guidelines

1. A log entry is created in the following situations:
   • When a Google employee accesses a user's content that was created using such a service. For example, an entry is created when a support engineer helps troubleshoot a Calendar issue.
   • The user grants a Google employee access to the data by sharing the file directly with them.
   • Notifying the customer of an access event is prohibited by law.
   • The data that Google accesses is an identifier on a publicly accessible resource, such as a document ID.
   • The data is accessed by a system task, such as a data compression or machine learning task. In this case, Google uses an internal version of binary authorization to ensure that the system code that runs on transparently enabled services is verified by a second party.
2. A log entry is not created in the following cases:
   • The user grants a Google employee access to the data by enabling public link sharing for the file.
   • Notifying a customer of an access event is prohibited by law.
   • The data that Google accesses is an identifier on a publicly accessible resource, such as a document ID.
   • The data is accessed by a system task, such as a data compression or machine learning task. In this case, Google uses an internal version of binary authorization to ensure that the system code that runs on transparently enabled services is verified by a second party.