This is a print-friendly report. Click Print and choose “Save as PDF” in the destination dropdown to download.
SaaSGuard Risk Report
Google Workspace
workspace.google.com
Generated May 4, 2026
Grade D
Score: 49 / 100
Executive summary
We analyzed Google Workspace’s Terms of Service across 8 risk dimensions and found 18 flagged clauses across 7 categories. 1 material change detected in the recent crawl history.
Recent material changes
1/15/2024 · severity 4
Google updated Workspace terms to allow Gemini AI to process emails, documents, and meeting transcripts when Gemini features are enabled. The prior clause had an explicit prohibition on using customer data for general AI model development.
Enterprises using Google Workspace for sensitive internal communications — any admin who enables Gemini features (often on by default for paid tiers) authorizes email and document content to be processed by Google's AI infrastructure.
Flagged clauses by category
Auto-renewal traps (2)
Severity 3 · notable
“If either party does not want the GWS Services or Cloud Identity Services to renew, then it must notify the other party to this effect at least 15 days before the end of the then-current Order Term, and this notice of non-renewal will take effect at the end of the then-current Order Term.”
Google Workspace renews your subscription automatically at the end of your contract term unless you give them 15 days' notice before renewal.
You could be locked into another year of service at a potentially higher price if you forget to cancel in time.
Severity 3 · notable
“With an Annual/Fixed-Term Plan. At the end of each Order Term for an Annual/Fixed-Term Plan, the GWS Services or Cloud Identity Services will renew consistent with Customer’s elections in the Order Form or Admin Console.”
Google Workspace renews your subscription automatically at the end of your contract term unless you give them 15 days' notice before renewal.
You could be locked into another year of service at a potentially higher price if you forget to cancel in time.
Surprise price hikes (2)
Severity 4 · material
“Google may change the Fees at any time unless otherwise expressly agreed in an addendum or Order Form.”
Google can change the price of your subscription at any time, unless you have a specific addendum or order form that says otherwise.
Your costs could increase significantly with little notice, even mid-contract if not explicitly protected.
Severity 3 · notable
“For GWS Services, Looker (original) Services, and Cloud Identity Services only, (a) Google will notify Customer at least 30 days in advance of any changes, and (b) Customer's pricing will change if and when Customer's Order Term renews after the 30-day period.”
Google will tell you 30 days before they change prices, and your new price will apply when your current contract term renews.
You have a limited window to react to price changes before they are automatically applied to your next billing cycle.
Data residency (1)
Severity 3 · notable
“Google may subcontract obligations under this Agreement but will remain liable to Customer for any subcontracted obligations.”
Google may use subcontractors for services but remains responsible for their work.
While Google is liable, a subcontractor's error could still cause you data issues or service disruptions.
Termination friction (2)
Severity 3 · notable
“If this Agreement or an Order Form is terminated or not renewed, then (a) all rights and access to the Services (or in the case of termination of an Order Form, the applicable Services) will terminate (including access to Customer Data, if applicable), unless otherwise described in this Agreement or the Order Form, and (b) all Fees owed by Customer to Google under this Agreement or Order Form, as applicable, are immediately due upon Customer’s receipt of the final electronic bill or as stated in the final invoice.”
If you end your contract, you lose access to your data and owe all remaining fees immediately.
You'll be cut off from your data and still have to pay for the rest of the contract term.
Severity 3 · notable
“Unless expressly stated otherwise in this Agreement or required by law, termination or non-renewal under any section of this Agreement (including the Cloud Data Processing Addendum or any Order Form) will not oblige Google to refund any Fees.”
Google does not owe you any refunds if you terminate or don't renew your contract, unless the contract or law says otherwise.
You might not get any money back for unused portions of your subscription if you decide to leave early.
Liability caps (2)
Severity 4 · material
“Each party's total aggregate Liability for damages arising out of or relating to this Agreement in connection with the GCP Services, GWS Services, SecOps Services, Looker (original) Services, or Cloud Identity Services, as applicable, is limited to the Fees Customer paid for such Services during the 12 month period before the event giving rise to Liability, except Google’s total aggregate Liability for damages arising out of or related to Services or Software provided free of charge is limited to $5,000.”
If Google messes up, the most they'll pay you back is the amount you paid them in the last 12 months, or $5,000 for free services.
Their liability is capped at your past spending, meaning you might not be fully compensated for significant losses.
Severity 4 · material
“To the extent permitted by applicable law and subject to Section 12.3 (Unlimited Liabilities), neither party will have any Liability arising out of or relating to this Agreement for any (a) indirect, consequential, special, incidental, or punitive damages or (b) lost revenues, profits, savings, or goodwill.”
Neither you nor Google are liable for indirect damages like lost profits or revenue.
You can't recover costs associated with lost business opportunities or revenue if Google's service fails.
Indemnification (1)
Severity 3 · notable
“Customer will defend Google and its Affiliates providing the Services and indemnify them against Indemnified Liabilities in any Third-Party Legal Proceeding to the extent arising from (a) any Customer Application, Project, Customer Data, or Customer Brand Features; or (b) Customer's or an End User's use of the Services in breach of the AUP or Section 3.3 (Restrictions).”
You must defend Google if a third party sues them because of your data, applications, or misuse of their services.
You could be responsible for legal fees and damages if your content or actions lead to a lawsuit against Google.
Right to silently change terms (8)
Severity 4 · material
“Google may make updates to this Agreement from time to time. Google will post any update to this Agreement to https://cloud.google.com/terms/. This subsection 1.4(b) does not apply to updates to the URL Terms, which are governed by subsection 1.4(c) below.”
Google can update the terms of this agreement at any time by posting them online.
You must regularly check Google's website to stay informed about changes to the contract you're bound by.
Severity 4 · material
“If Customer does not agree to any update to the Agreement regarding GCP or its TSS, Customer may stop using the GCP Services or TSS. Customer may also terminate this Agreement for convenience under Section 8.5 (Termination for Convenience). Customer's continued use of the GCP Services or TSS after a material update will constitute Customer's consent to such update.”
If Google updates the terms for GCP or TSS, you can stop using the service or terminate the agreement, otherwise continued use means you agree.
Simply continuing to use the service after an update means you accept any new terms, even if unfavorable.
Severity 4 · material
“Google may make commercially reasonable updates to the URL Terms from time to time by posting any such update at the relevant URL Term. Unless otherwise noted by Google, material updates to the URL Terms will become effective 30 days after they are posted.”
Google can update terms linked to specific URLs, which usually take effect 30 days after being posted.
You need to monitor specific URLs for changes that will automatically apply to your service after a short notice period.
Severity 4 · material
“Google may only update the Cloud Data Processing Addendum where such update is required to comply with applicable law or expressly permitted by the Cloud Data Processing Addendum, or where such update: (i) is commercially reasonable; (ii) does not result in a material reduction of the security of the Services; (iii) does not expand the scope of or remove any restrictions on Google's processing of "Customer Personal Data," as described in the "Compliance with Customer's Instructions" Section of the Cloud Data Processing Addendum; and (iv) does not otherwise have a material adverse impact on Customer's rights under the Cloud Data Processing Addendum.”
Google can update the Data Processing Addendum if required by law, or if the update is commercially reasonable and doesn't reduce security or expand data processing scope.
While protections exist, Google can still modify data handling terms under certain conditions without your explicit consent.
Severity 4 · material
“Subject to the last sentence in this Section 1.4(e) (Discontinuation of Services), Google will notify Customer at least 12 months before: (i) discontinuing any Service (or associated material functionality) unless Google replaces such discontinued Service or functionality with a materially similar Service or functionality; or (ii) significantly modifying a Customer-facing Google API in a backwards-incompatible manner.”
Google will give you 12 months' notice before discontinuing a service or making a backward-incompatible change to a customer-facing API.
You have a year to migrate away from a service or API before it's changed or removed, but significant disruption is still possible.
Severity 4 · material
“Nothing in this Section 1.4(e) (Discontinuation of Services) limits Google's ability to make changes required to comply with applicable law, address a material security risk, or avoid a substantial economic or material technical burden.”
Google can change services to comply with law, address security risks, or avoid significant technical or financial burdens.
Service changes can happen quickly for legal or security reasons, potentially impacting your operations without prior warning.
Severity 4 · material
“Google may change its offering of billing options (including by limiting or ceasing to offer any billing option) upon 30 days’ notice to Customer and any such change will take effect at the beginning of Customer’s next Order Term.”
Google can change your billing options with 30 days' notice, effective at the start of your next contract term.
Your payment methods or billing structure could change, requiring you to adapt your financial processes.
Matches X Corp. Verified User Class Action (2024)
Severity 4 · material
“Google may make commercially reasonable updates to the Services from time to time.”
Google can make reasonable updates to its services as needed.
Features you rely on might change or be removed with little notice, potentially disrupting your workflow.
Methodology
SaaSGuard uses an automated pipeline: a daily Playwright crawler captures each vendor’s public Terms of Service, Privacy Policy, and DPA. Google’s Gemini 2.5 Flash classifies each clause into one of 8 risk categories with a severity score (1–5). Clauses are cross-referenced against a curated database of real lawsuits and FTC actions via embedding-based similarity matching. Grades are computed from per-category max severity; full source code is available on request.