Skip to main content
Suitebriar(888) 545-3685Talk to a Google expert
A man reviewing printed documents at his desk while colleagues talk behind him
Cybersecurity & Compliance

Compliance automation
on Google Workspace and Cloud.Automate evidence collection and streamline compliance.

Suitebriar delivers compliance automation programs leveraging Google Cloud tools, Workspace capabilities, and third-party integrations to help accelerate SOC 2, HIPAA, ISO 27001, and other certification journeys.

Talk through your auditWhat Google provides

Trusted by teams at

  • Reddit
  • Cloudflare
  • Okta
  • Zapier
  • Dialpad
  • Prezi
  • Century 21 Canada
  • Berkshire Hathaway HomeServices Homesale Realty

What can Google Workspace do for HIPAA, SOC 2 and ISO 27001?

Google Workspace provides controls and records your auditor will ask about: a Business Associate Agreement for patient data, Vault retention and holds, admin audit logs, DLP rules, and Google's own SOC 2 and ISO 27001 reports for your vendor review. Whether you meet a framework depends on how you configure and use them, and your own audit is done by your auditor.

Three things catch people out. Workspace can hold patient data only after an admin accepts Google's BAA, and only in the services it covers: Gmail, Drive, Meet and Gemini in Workspace are covered, while Gemini in Chrome, Gemini Notebook and third-party add-ons are not. Vault keeps nothing until retention rules exist, and deletes data for good when a rule's period ends. And admin audit logs are kept for six months, so a twelve-month audit period needs planning.

A doctor working on a laptop at her desk in a clinic office

What's included

Gap assessments

One input is Google's security health page, which shows which security settings are on in each organizational unit.

Control design + implementation

Workspace controls auditors ask about: 2-Step Verification enforcement, Drive sharing limits, and DLP rules and Context-Aware Access on Enterprise editions.

Automated evidence workflows

Evidence collection using Google Cloud tools, Workspace capabilities and third-party integrations.

Workspace retention + Vault configuration

Retention rules and holds for Gmail, Drive, Chat and Meet. Vault keeps nothing until a rule exists, and every admin and user it covers needs a Vault license.

Policy and documentation support

Documents an auditor asks for include your BAA acceptance record in the Admin console and Google's SOC 2 Type II reports from the Compliance Reports Manager.

What Google provides, and what stays with you

Google's reports describe Google's controls. Your audit covers yours.

AreaGoogle providesWhat your organization decides or does
HIPAAA Business Associate Agreement covering listed Workspace servicesAccept the BAA before any patient data goes in, keep it out of services the BAA doesn't cover, and limit who can reach it
SOC 2Quarterly SOC 2 Type II reports on Google Cloud and Workspace controlsYour own SOC 2 audit of your controls, by your auditor
ISO/IEC 27001Google's certified ISMS, covering Workspace, with certificates in the Compliance Reports ManagerYour own certification; Google's certificate shows how it meets the requirements for its services
RetentionVault retention rules and holdsThe retention periods, with legal input, and Vault licenses for everyone covered
Audit logsAdmin activity logs, kept for six monthsKeeping whatever your audit period needs beyond six months
Data protectionDLP rules in Gmail, Drive and Chat on Enterprise, Frontline and Education editionsWhat counts as sensitive, and what happens when it's found

Preparing Google Workspace for an audit

  1. Decide what's in scopeWhich frameworks, which organizational units, and which kinds of data, including whether any of it is patient data.
  2. Accept the BAA, if you hold patient dataBefore any goes in, in Account settings, Legal and compliance. Then check which services and Gemini features it covers.
  3. Set retention on purposeVault retention rules for each kind of data, with legal input on the periods, and Vault licenses for everyone they cover.
  4. Keep the evidenceDownload Google's SOC 2 reports and ISO 27001 certificates, and keep admin logs your audit period needs before six months pass.
Two colleagues going through papers together beside a laptop

Related work

Patient data and retention in other projects

Patient dataHamilton Healthcare SystemsA rural Texas healthcare provider moved its mail and file servers to Google Workspace with Suitebriar and signed Google's Business Associate Agreement.Read the story RetentionAmerican Samoa GovernmentSuitebriar set up Google Vault with retention policies so each of the government's organizations could comply with the laws and standards that apply to it.Read the story

Compliance FAQ

What IT, security and compliance leads ask about HIPAA, SOC 2 and ISO 27001 on Google Workspace.

Preparing for an audit?

Tell us which frameworks you're working toward and when your audit is, and we'll talk through what Google Workspace can provide.

(888) 545-3685Talk through your audit
Is Google Workspace HIPAA compliant?

Not by itself. Workspace can be used for patient data once an admin accepts Google's Business Associate Agreement in the Admin console, and only in the services that agreement covers; Google says customers who haven't signed it must not put patient data in Workspace. Third-party add-ons and Marketplace apps aren't covered. Whether you meet HIPAA then depends on how you configure access and sharing and how your people use it.

Are Gmail, Meet and Gemini covered by Google's BAA?

Gmail, Meet, Drive, Calendar, Chat, Vault and Gemini in Workspace are on Google's list of services the BAA covers. Gemini in Chrome and Gemini Notebook are not, so turn them off for anyone handling patient data.

Does Google's SOC 2 report count toward our SOC 2?

It counts as vendor evidence, not as your report. Google's quarterly SOC 2 Type II reports describe Google's controls, and you can use them to assess the risk of relying on Workspace. Your own SOC 2 covers your controls and is done by your auditor.

Who certifies us?

Your auditor. Google's ISO 27001 certificate covers Google's own security management, and Google says customers have to obtain their own certification; its certificate helps you see which requirements Google already meets for its services.

Related services

Cybersecurity & ComplianceSecurity assessments, Zero Trust, email security and complianceSecurity Assessments & Risk ManagementStart with a Google Workspace security auditZero Trust Implementation for Google WorkspaceContext-Aware Access, device management and app controlsGoogle Workspace with GeminiRoll out, govern and train on Gemini

Talk through your audit

Tell us which frameworks you're working toward, your Workspace edition and when your audit is due.

  • Google Cloud Premier Partner, working only on Google Cloud and Workspace for more than a decade
  • U.S.-based support team

Free AI starter kit

From your data to your first AI agents, in four steps

Google's AI starter kit for lean teams: your four-step guide from data to agents.

  • Four steps, from a first no-code win to a multi-step agent workflow
  • Use cases with sample prompts, plus the ABCD prompting technique
  • Best practices for data quality, governance and human oversight