Securing Google Gemini
Use Google Gemini at Work Without Exposing Personal Data
Gemini comes in two very different flavors. Gemini in Google Workspace, signed in with a work account, falls under Google's Workspace terms, which say your content isn't used to train models outside your domain. The consumer Gemini app with a personal Google account has its own privacy settings, and Google notes that reviewers may read some conversations. Check Google's current terms for each.
In both, prompts and uploads go to Google for processing. People paste customer emails, upload spreadsheets and share documents with Gemini to summarize them, and the personal data in them goes along.
What the employee types
Draft a reply to Ada Lovelace about her
refund of CHF 2,400 to card
4532 7781 0021 9047
IBAN CH93 0076 2011 6238 5295 7
What the AI provider receives
Draft a reply to mf_mask_170b about her
refund of mf_mask_9c2e to card
mf_mask_41af
IBAN mf_mask_d7e0
Why the usual approach falls short
Workspace settings decide which Google features are on. Maskflare decides what personal data reaches Gemini, and keeps work off personal Google accounts.
The Maskflare approach
The desktop agent routes Gemini web traffic through Maskflare. Personal data and secrets in prompts are masked before Google sees them and restored in the answer; uploads are scanned and images read with OCR; answers are inspected. Maskflare tells Workspace accounts from personal Google accounts, so you can allow one and block the other. For apps calling the Gemini API, the Maskflare gateway applies the same rules with one base-URL change.
Benefits
Prompts
Masked before Google processes them, restored in Gemini's answer.
Uploads
Documents and spreadsheets scanned; images read with OCR; blocked data stopped.
Workspace vs personal
Allow Gemini with work accounts and block personal Google accounts on company devices.
Gemini API too
Applications using the Gemini API get the same rules through the gateway.
Coaching
Warn-and-justify prompts that link your AI policy.
Built on
Understand the underlying risks
Frequently asked questions
Is Gemini in Google Workspace used for training?
Google's Workspace terms say customer content isn't used to train models outside your domain without permission. The consumer Gemini app follows the user's activity settings. Check Google's current terms.
Can we block personal Gemini use on company laptops?
Yes. Maskflare tells Workspace accounts from personal Google accounts and can block the personal ones.
Are uploads to Gemini checked?
Yes. Documents are scanned, images are read with OCR, and files with blocked data are stopped.
Does it work for the Gemini API?
Yes. Change your app's base URL to the Maskflare gateway and the same rules apply, including streaming.
Is Gemini GDPR compliant?
It depends on the account type and contract; see our Gemini GDPR article. Masking reduces the personal data Google processes either way.
Will masked prompts still work?
Yes. Gemini sees consistent tokens, and Maskflare restores the real values where the answer repeats them.
See it on your own data
Try Maskflare free.
Bring your hardest prompts.
28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.
- SOC 2 Type II: In progress
- ISO 27001: In progress
- EU hosting by default · on-premises available
- Prompts and files never stored
- Never used to train AI models
- GDPR · nDSG · DPA available
- Trust center →