Google は、Document AI サービスを提供するために必要な場合を除き、お客様が送信したドキュメントを公開したり、第三者と共有したりすることはありません。たとえば、ストレージやデータ伝送などのサービスの一部を提供するためにサードパーティ ベンダーを利用しなければならない場合があります。Google のベンダーには、適切なセキュリティおよび機密性保持に関する契約上の義務があります。その他の目的で、送信された書類を第三者と共有したり、公開したりすることはありません。
Google は、Document AI に送信したドキュメント、結果、リクエストに関するその他の情報を、サーバーにどのくらいの期間、どこに保存しますか？アクセスできますか？
オンライン（即時応答）処理の場合、ドキュメント データ（リクエストで送信）はメモリ内で処理され、転送中に暗号化され、ディスクには保存されません。また、サービス向上と不正行為対策のために、Document AI API リクエストに関する一部のメタデータ（リクエストの受信時刻やリクエストのサイズなど）が一時的に記録されます。
Document AI へのリクエストで送信したコンテンツの所有権を Google が主張することはありますか？
Document AI に送信したコンテンツ（ドキュメントや予測を含む）のいずれの所有権についても Google が主張することはありません。ドキュメントとカスタムモデルは、お客様のデータ（非公開）と見なされます。Google がモデルの改善にお客様のデータを使用することはありません。両者がそのような取り決めに同意するまれな状況では、明示的なデータ共有契約が作成されます。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-04 UTC。"],[[["\u003cp\u003eDocument AI prioritizes data security by utilizing Google Cloud's security measures, supporting features like Data Residency, VPC Service Controls, Access Transparency, and Customer-Managed Encryption Keys (CMEK).\u003c/p\u003e\n"],["\u003cp\u003eDocument AI maintains compliance with various standards, including ISO 27001, ISO 27017, ISO 27018, SOC 2, SOC 3, PCI DSS, FedRAMP High, and HIPAA.\u003c/p\u003e\n"],["\u003cp\u003eGoogle does not use customer data to improve Document AI models, nor does it share or publicly expose customer documents, except when necessary for service provision with third-party vendors who are under strict confidentiality agreements.\u003c/p\u003e\n"],["\u003cp\u003eDocuments sent via batch requests are stored briefly, encrypted with an ephemeral key, and typically deleted immediately after processing, while data from online requests is processed in memory and not persisted to disk, though some metadata may be logged temporarily.\u003c/p\u003e\n"],["\u003cp\u003eCustomers are required to redact Personally Identifiable Information (PII) before sharing documents with Google for support purposes, and can control Google Cloud support access to their data through Access Approvals and Access Transparency features.\u003c/p\u003e\n"]]],[],null,["# Document AI security and compliance\n===================================\n\nFollowing are questions and answers applicable in various areas.\n\nSecurity\n--------\n\nTo ensure service security in Document AI, review the following topics.\n\n### How does Google protect and ensure the security of the data I send to Document AI?\n\nRefer to the [Google Cloud Security](/security/solutions) page, which describes the security measures in place for Google Cloud Services.\n\n### What security features does Document AI offer to protect from horizontal attacks that move system to system?\n\nDocument AI supports the following:\n\n- [Data residency](/terms/data-residency)\n- [Deny policy](/iam/docs/deny-overview)\n- [VPC Service Controls (VPC-SC)](/vpc-service-controls/docs/supported-products)\n - [Identity groups and third-party identities in ingress and egress rules](/vpc-service-controls/docs/configure-identity-groups).\n- [Access Transparency](/assured-workloads/access-transparency/docs/supported-services)\n- [Customer-managed encryption keys (CMEK)](/kms/docs/using-other-products)\n - [Using CMEK with Document AI](/document-ai/docs/cmek)\n\nSecurity compliance\n-------------------\n\nThis section describes the questions related to compliance.\n\n### What compliance does Document AI offer?\n\nGoogle Cloud undergoes regular independent third-party audits to verify alignment\nwith security, privacy, and compliance controls. Google Cloud has regular audits\nfor standards such as ISO 27001, ISO 27017, ISO 27018, SOC 2, SOC 3, and PCI DSS.\n\nYou can read more about Google Cloud compliance on the [Compliance resource center](/security/compliance).\n\n### Is Document AI FedRAMP compliant?\n\nDocument AI is [FedRAMP High compliant](/security/compliance/fedramp).\n\n### Is Document AI HIPAA compliant?\n\nDocument AI is [HIPAA compliant](/security/compliance/hipaa-compliance).\n\nSecurity data usage\n-------------------\n\nThis section describes data inquiries.\n\n### Does Google use customer data to improve models?\n\nNo. Google does not use any of your content (such as documents and predictions)\nfor any purpose except to provide you with the Document AI service.\nSee section 17 of the [Google Cloud Terms of Service](https://cloud.google.com/terms/service-terms).\n\nAt Google Cloud, we never use customer data to train our Document AI models.\n\nFor more information, see the [Transparency \\& data protection](/transparency) page.\n\n### In the future, will Google share the document I send to Document AI?\n\nWe won't make the document that you send available to the public or share it with\nanyone else, except as necessary to provide the Document AI service. For\nexample, sometimes we may need to use a third-party vendor to help us provide\nsome aspect of our services, such as storage or transmission of data. Our vendors are\nunder appropriate security and confidentiality contractual obligations. We don't\nshare documents you send with other parties or make them public for any other purpose.\n\n### How long and where will Google store documents I send to Document AI, their results, or other information about requests on its servers? Can I access it?\n\nWhen you send a document to Document AI using a batch request, we must store that\ndocument (encrypted with an ephemeral key, meaning that no human has access to it)\nfor a short period of time in order to perform the analysis and return the results\nto you. For batch operations, the stored document is typically deleted immediately\nafter the processing, with a failsafe [Time to live (TTL)](https://en.wikipedia.org/wiki/Time_to_live)\nof one day. If the batch abends abnormally, the data may persist with a TTL of\nup to one day.\n\n### Synchronous processes\n\nFor online (immediate response) operations, the document data (sent in the request)\nis processed in memory, encrypted in flight, and not persisted to disk. Google\nalso temporarily logs some metadata about your Document AI API requests\n(such as the time the request was received and the size of the request) to\nimprove our service and combat abuse.\n\nFor more information, see [Encryption in transit](/docs/security/encryption-in-transit) and [Regions](/document-ai/docs/regions).\n\n### Does Google claim ownership of the content I send in the request to Document AI\n\nGoogle does not claim any ownership in any of the content (including documents and\npredictions) that you transmit to Document AI. Documents and custom models\nare considered to be (private) customer data. We never use customer data to\nimprove our models. In the rare circumstance where both parties agree to such an\narrangement, an explicit data sharing agreement is crafted.\n\n### What is considered Personally Identifiable Information (PII) that needs to be redacted on documents before being shared with Google?\n\n| **Note:** *Sharing* refers to sending documents to Google for support and professional services purposes. It does not refer to documents processed through Document AI. Such documents are considered private customer data, much like Cloud Storage. No Google employee ever sees them nor extracts their data.\n\nFor document sharing purposes, PII is any information defined as personal\nidentifiable data under applicable laws. Customers must redact the documents prior\nto sharing them with Google, for example when voluntarily done for technical\nsupport purposes to reproduce a problem.\n\nExamples of PII include but are not limited to:\n\n- Date of birth, for example: `2/10/1988`\n- Names of individuals, for example: `Kiran Darko`\n- Personal address, for example: `Evergreen terrace 123`\n- Email address of individuals, for example: `rivelro@test-mail.com`\n- Telephone number of individuals, for example: `636-555-3226`\n- Driver's license number\n- National ID number\n- Employer identification number\n- Bank account information: account IDs, routing numbers, SWIFT IDs\n- Payment card number\n- Gender, for example: `Female, Male, Nonbinary`\n- Ethnicity, for example: `Berber, Italian, Japanese, Latino, Ukrainian`\n- Usernames, ID number of third parties\n- Passport number, for example: `AA1001111`\n- Marital status, for example: `Single, Divorced`\n- Number of allowances or exemptions\n- Dependent names\n- Vehicle identifiers (VIN, license plates, etc.)\n- Any other unique identifying number, characteristic, or code of an individual that could identify an individual consumer, family, or device over time or across services\n\n### Can I resell the Document AI API?\n\nNo, you are not permitted to resell Document AI service. You can still\nintegrate Document AI into applications of independent value.\n\n### How can customers control Google Cloud support access to their documents or data?\n\nAll Document AI parsers support Access Transparency and access approvals. By\ndefault, Google support wouldn't have access to any of customer data or applications.\nIn the situation where access is required from the Google support team, customers\ncan use the [Access Approval](/access-approval/docs/overview) process to authorize\naccess to data or applications. This process starts with the creation of a ticket\nin the Google support portal. The customer then receive a notification (usually\nemail) and an option to authorize or deny access.\n\nGoogle also offers a service called [Access Transparency](/security/products/access-transparency),\nwhich gives customer visibility into all the tasks that Google support performs\nwhile they have access to the system."]]
