本頁面提供資料存取透明化控管機制總覽。資料存取透明化控管機制是 Google 長期致力於資訊公開、使用者信任和客戶擁有資料的一部分。存取權核准可讓您授權 Google 人員存取客戶資料，資料存取透明化控管機制則可協助您瞭解客戶資料的存取時間。如果客戶使用以客戶管理的加密金鑰 (CMEK) 簽署的存取權核准，Google 也會透過金鑰存取依據，讓使用者瞭解及控管金鑰存取要求。
這些產品各自提供存取權管理功能，讓您控管管理要求，並提供客戶資料存取權的相關資訊。
總覽
資料存取透明化控管機制記錄會記錄 Google 人員存取客戶資料時採取的動作。資料存取透明化控管機制記錄項目包含詳細資料，例如受影響的資源和動作、動作時間、動作原因，以及存取者相關資訊。存取權限資訊包括 Google 員工的實際地點、雇用實體和職業類別等詳細資料。如要進一步瞭解資料存取透明化控管機制記錄檔中的詳細資料，請參閱記錄欄位說明。
資料存取透明化控管機制記錄與 Cloud 稽核記錄類似，但 Cloud 稽核記錄會記錄 Google Cloud機構成員在 Google Cloud 資源中採取的動作，而資料存取透明化控管機制記錄則會記錄 Google 人員採取的動作。將 Cloud 稽核記錄和資料存取透明化控管機制記錄檔搭配使用，即可針對客戶動作和 Google 管理員對客戶資料的存取權，提供稽核記錄。
使用資料存取透明化控管機制的時機
您可能需要以下資料存取透明化控管機制記錄：
確認 Google 人員僅基於正當業務理由 (例如修正服務中斷問題或處理您的支援要求) 存取您的內容。
資料存取透明化控管機制記錄是安全作業工作流程中的額外資訊來源。您可以將資料存取透明化控管機制記錄擷取至安全性資訊和事件管理 (SIEM) 工具，以便進行法規遵循或稽核作業，藉此擴充任何現有資料，例如 Security Command Center 的安全性發現項目。如要進一步瞭解資料存取透明化控管機制記錄擷取功能，請參閱「將資料擷取至 Google Security Operations」 Google Cloud 。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eAccess Transparency provides logs detailing when Google personnel access Customer Data, including the action, time, reason, and accessor information.\u003c/p\u003e\n"],["\u003cp\u003eAccess Transparency logs are similar to Cloud Audit Logs, but they track Google personnel actions rather than user actions within your Google Cloud organization.\u003c/p\u003e\n"],["\u003cp\u003eThese logs help verify that Google personnel access content only for valid reasons, such as fixing outages or addressing support requests, and they can verify legal or regulatory compliance.\u003c/p\u003e\n"],["\u003cp\u003eAccess Transparency logs improve overall security by allowing ingestion into SIEM tools for compliance, auditing, and augmenting existing data like Security Command Center findings.\u003c/p\u003e\n"],["\u003cp\u003eGoogle has strict policies regarding access to Customer Data, including required justifications for privileged access, employee confidentiality agreements, and a policy of directing government requests to the customer.\u003c/p\u003e\n"]]],[],null,["# Overview of Access Transparency\n===============================\n\nThis page provides an overview of Access Transparency. Access Transparency is a part of\nGoogle's long-term commitment to transparency, user trust, and customer\nownership of their data.\n[Access Approval](/assured-workloads/access-approval/docs/overview)\nlets you authorize requests from Google personnel to access\n[Customer Data](/terms/data-processing-addendum), Access Transparency helps you\ndiscover information about when Customer Data is accessed. For customers who use\naccess approvals that are signed with a customer-managed encryption key (CMEK),\nGoogle also provides users with visibility and control to key access requests\nthrough\n[Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview).\n\nTogether, each of these products provide access management capabilities that\ngive you control over and context for administrative requests to access Customer\nData.\n\nOverview\n--------\n\nAccess Transparency logs record the actions that Google personnel take when\naccessing Customer Data. Access Transparency log entries include details such as\nthe affected resource and action, the time of the action, the reason for the\naction, and information about the accessor. The information about the accessor\nincludes details about the physical location, employing entity, and job category\nof the Google employee. For more information about the details covered in\nAccess Transparency logs, see\n[Log field descriptions](/assured-workloads/access-transparency/docs/reading-logs#axt-log-entry-sample).\n\nAccess Transparency logs are similar to [Cloud Audit Logs](/logging/docs/audit);\nhowever, Cloud Audit Logs record the actions that members of your Google Cloud\norganization have taken in your Google Cloud resources, whereas\nAccess Transparency logs record the actions taken by Google personnel. When used\ntogether, Cloud Audit Logs and Access Transparency logs provide you audit logging on both\ncustomer actions and Google administrative accesses to Customer Data.\n| **Note:** If you need to approve access requests by Google personnel before they can access your Google Cloud resources, see the [Access Approval documentation](/assured-workloads/access-approval/docs).\n\nWhen to use Access Transparency\n-------------------------------\n\nYou might need Access Transparency logs for the following reasons:\n\n- Verifying that Google personnel are accessing your content only for valid business reasons, such as fixing an outage or attending to your support requests.\n- Verifying that Google personnel access aligns to the products and data you're seeking assistance with on a customer support case.\n- Verifying and tracking compliance with legal or regulatory obligations.\n- Collecting and analyzing tracked access events through an automated security information and event management (SIEM) tool such as [Google Security Operations](/chronicle/docs/secops/secops-overview).\n\nUse Access Transparency logs to improve the overall security posture\n--------------------------------------------------------------------\n\nAccess Transparency logs are a valuable additional source of information in your\nsecurity operations workstreams. By ingesting Access Transparency logs into your\nsecurity information and event management (SIEM) tools for compliance or\nauditing purposes, you can augment any existing data, such as Security Command Center\nsecurity findings. For more information about Access Transparency log ingestion, see\n[Ingest Google Cloud data to Google Security Operations](/chronicle/docs/ingestion/cloud/ingest-gcp-logs#export-logs).\n\nGoogle Cloud services that produce Access Transparency logs\n-----------------------------------------------------------\n\nFor the list of Google Cloud services that produce Access Transparency logs, see\n[Supported services](/assured-workloads/access-transparency/docs/supported-services).\n\nWhen can Google personnel access customer content?\n--------------------------------------------------\n\nGoogle personnel are strictly restricted in what is visible to them. All\naccess to Customer Data requires a valid justification for\n[privileged access](/assured-workloads/access-transparency/docs/privileged-access#why-access).\nSee [Justification reason codes](/assured-workloads/access-transparency/docs/reading-logs#justification_reason_codes)\nfor the list of valid business justifications.\n\nHow does Google train its employees on the confidentiality of customer content?\n-------------------------------------------------------------------------------\n\nAll Google employees are required to execute a confidentiality agreement and\ncomply with\n[Google's Code of Conduct](https://abc.xyz/investor/other/google-code-of-conduct/).\nFor more information on employee onboarding and security and privacy training,\nsee the [Google security whitepaper](/security/overview/whitepaper).\n\nHow does Google handle government requests for customer content?\n----------------------------------------------------------------\n\nIf Google receives a government request for Customer Data, it is Google's policy\nto direct the government to request such data directly from the Google Cloud\ncustomer. For more information, see\n[Google Cloud Government Requests whitepaper](https://services.google.com/fh/files/misc/google_cloud_governmentrequestsfor_cloud_customer_data_v2_1018.pdf).\n\nWhat's next\n-----------\n\n- To learn about the core principles upon which controls that prevent unauthorized administrative access are based, see [Overview of administrative access controls](/assured-workloads/cloud-provider-access-management/docs/administrative-access).\n- To understand the contents of Access Transparency log entries, see [Understanding and using Access Transparency logs](/logging/docs/audit/reading-access-transparency-logs).\n- For information on Google Cloud's privileged access principles, see [Privileged access](/assured-workloads/access-transparency/docs/privileged-access).\n- For more information on the controls Google has put in place for protecting customer content, see the [Google security whitepaper](/security/overview/whitepaper)."]]
