This document answers common questions about Business Messages data security and associated topics.
Business Messages is a conversational channel delivered over the internet, not through your mobile carrier’s network. Business Messages is not related to SMS, MMS, or RCS and it is independent of any third-party over-the-top (OTT) messaging applications that a consumer might use. This means that entry points to Business Messages cannot redirect to these other applications.
Partners who wish to use Business Messages (either directly or through the Business Communications Developer Console) must agree to the Terms of Service, including the Acceptable Use Policy.
Third-party certification
Is Business Messages certified by any third parties?
Business Messages has received ISO 27001,SOC 2, and SOC 3 certifications. Ask your account manager if you’d like copies of the certificates.
Data storage and encryption
What is the messaging architecture and flow for Business Messages? Which elements are encrypted?
Messages sent between brands and end users are encrypted between the end user’s device and Google’s servers and also between Google’s servers and the messaging partner through Google’s Business Messages API.
See Life of a Message for an overview of the end-to-end messaging flow and the roles of all parties involved.
Are stored messages encrypted?
Yes, the messages stored on Google servers are encrypted at rest and ACL protected.
Does Business Messages use persistent storage? Where is the information stored?
Business Messages agent assets (logo, name, description, etc): Persistently stored in global Google storage
Messages in Google servers: Google stores encrypted messages to allow them to be synchronized on an end user’s devices and to ensure that previous messages are shown on an end user’s new device. Stored messages cannot and will not be shared with any third party. Except for instances where end users have given explicit permission for their messages to be reviewed, access to stored messages is only available with the end user’s Google ID, meaning that only that specific end user can access their data.
Other Google products and services (such as YouTube, Photos, Stadia, Gmail, and Chat) use an identical storage system.
Messages on an end user's device: Stored on the end user’s device perpetually, unless the end user chooses to delete them
What data is stored on the end user’s device?
Message history is stored on the end user’s device. This may include personal information shared with a Business Messages agent within a secure flow.
Can a brand control the encryption keys for its messages stored at Google?
No. To protect end users from spam, Google needs to scan messages for malicious content, such as phishing and malware URLs. Google uses automated protections to scan messages, and the message contents are not accessible to humans.
Authentication with OAuth
Can Google obtain the access tokens sent by the OAuth provider?
No. Google never obtains the access tokens sent by the OAuth provider during user authentication. OAuth 2.0 uses the Proof Key for Code Exchange (PKCE) to secure the authentication flow.
Privacy and security
What reporting does Google do on Business Messages agents (e.g., brand-to-consumer interactions)?
Google has internal reporting on the gross number of users, messages, and responses for each agent based on the last 35 days' data. Google uses this data for diagnostics and system improvements. Beyond 35 days, Google stores only aggregate reporting data; there is no time limit on this storage. Any aggregate data shared externally has a time to live (TTL) lifespan of 18 months.
Does Google use end user data outside of Business Messages?
Google’s use of end user data is governed by Google’s privacy policy.
What Google will do with end user data:
- Measure and improve the performance of Business Messages for both users and brands. As part of this effort, Google shares aggregated data with partners so they can improve the messaging experience.
- Analyze user intent and satisfaction, task completion, and messaging outcomes through Machine Learning (ML) models designed to generate insights and optimize the conversational experience. When a user consents to share their conversation data, Google may use human reviewers to train the ML models. In this case, a limited number of reviewers has restricted and audited access to conversation data, including message contents. For details, see What happens when you consent to your conversation being reviewed. Examples of ML models using conversation data include intent detection and classification, task completion and outcome analysis, quality assessment, intent-based suggestions and responses, and FAQ bots.
- Understand when and why users click on message buttons
- Optimize the positioning of message buttons
- Detect and prevent spam and fraud
What Google won't do with end user data:
- Perform ad targeting based on message contents
- Share unaggregated data or message contents with any third parties or competitors
Does Google ever read messages between brands and end users?
Google cannot and does not read messages unless the end user gives explicit consent.
What happens when you consent to your conversation being reviewed
Reviewing conversation data helps Google develop special algorithms through machine learning (ML) to improve Business Messages chats. The purpose of these models is described in What Google will do with end user data.
When you consent to this review, the content of your conversations with the brand is used by human reviewers with temporary, restricted, and audited access to train and develop ML models. We take steps to protect your privacy as part of this process by only allowing manual review, without any identifiers attached, using an automatic tool that makes best efforts to redact personally-identifiable information from the message contents.
How we protect your data
The ML models eventually run automatically. However, as part of the initial training, a limited amount of human review is required to make sure the models will run without seeing your identity or the identity of the brand. Here’s how it works:
A human reviewer tags specific words or phrases in a conversation that indicate what questions you had initially and how helpful the brand was in answering them. These tags are used to develop and improve our initial ML model, eventually allowing the model to tag conversations on its own.
Next, we compare the human tagging to the ML tagging and make adjustments to help the ML model learn to review message content without human assistance.
Human reviewers can only access the chats for a 35-day period, and their access is logged for audit.
To learn more about the controls Google has in place to protect your data, including how technologies keep your information safe, visit policies.google.com.
What information about end users does Google provide to the brand?
When a user starts a conversation with a brand, Google provides some contextual data to the brand, including the user's name, locale, entry point, and place ID (for location-specific entry points). Google does not share the user's phone number or email address.
In the Terms of Service, what does it mean that Google and the partner are both Independent Data Controllers?
Since the user journey starts on a Google-owned entry point (such as the Search results page) and/or the conversation takes place on a Google conversational surface, the information passed in the conversation falls under Google's privacy policy. Since the end user is passing information to the brand, the conversation also falls under the privacy policy of the brand, which is linked from the top-right menu of all Business Messages conversations.
In the Acceptable Use Policy, does the Privacy and Security section limit a brand’s ability to collect and use information about its own customers?
We do not intend to restrict a brand's ability to serve its own customers. A conversation between an end user and a brand that is created through the Business Messages API can be stored by the brand, according to the terms of its own privacy policy with its users.
In the Terms of Service, what does it mean that “Company will provide a clear and conspicuous privacy notice to such individuals that accurately describes how Company collects, uses, and protects that information.”
We expect all brands using Business Messages to supply a privacy policy and offer guarantees that they will not use or share end user data without specific end user permission.
Auditing
What audit rights do brands have?
In the Terms of Service, refer to Exhibit B: Data Protection Safeguards, item 8: Security Auditing.
Our brand is subject to regulations that mean its providers must be available for audit. Will Google cooperate with this?
Google has teams that are dedicated to responding to law enforcement and regulator inquiries in accordance with applicable law.
Incident response
How does Google handle data breaches?
In the Terms of Service, refer to Exhibit B: Data Protection Safeguards, item 6: Incident Response.
Unsupported network capabilities
What capabilities are not supported by Business Messages?
- Custom headers to allow firewall pass-throughs
- Classless inter-domain routing (CIDR) block ranges from Google's services