Google Gemini Enterprise

Google Gemini Enterprise: a suite to buy, and an agent platform to build on

Google offers two products that a platform leader has to keep apart. The employee product is the Gemini Enterprise app, and Google's FAQ frames it as an advanced agentic platform meant for the whole workforce¹. Builders get a separate product, and Google says the Agent Platform is the evolution of Vertex AI². The two must be purchased separately³. In build-versus-buy terms, the app is the "buy" and the Agent Platform is the "build", and a Google Cloud customer can do both. Gemini Enterprise ranks sixth on this site.

What the app does

Google's docs fold three jobs into the app, finding things on the intranet, answering as an assistant, and hosting agents⁴. Search gives permissions-aware access to enterprise information⁵, and the product ships prebuilt connectors to commonly used third-party applications⁶. A companion product, Gemini Notebook Enterprise, handles research and summarizing across a team's sources⁷.

Any employee can make a custom agent without code, using what Google calls a workbench⁸. Two agents arrive ready-made, Deep Research for digging into hard questions on a user's behalf⁹ and, still in preview on Standard and Plus, Data Insights¹⁰. Agents made by Google partners can be picked up from a marketplace inside the product¹¹.

This is where the build side joins: agents coded with the Agent Platform or ADK can be published into the app by Standard and Plus customers¹², and agents living elsewhere can plug in over A2A¹³. That is the "both" path: engineers build specialized agents in code, and employees reach them in the same app they use for search and chat.

Editions

Editions are where buying gets complicated, because Google offers several, each tuned to a different size and type of buyer¹⁴. Even the documentation is divided, since Business has its own support center while the main docs serve the other editions¹⁵. The Business edition caps out at 300 users, a size Google pitches at small companies and departmental teams¹⁶. Moving to Standard or Plus removes the seat ceiling and adds bigger quotas, outside agents and Gemini Code Assist¹⁷, with a Frontline add-on available for frontline workers^18,19. Public bodies and schools are steered toward special editions such as Gemini for Government²⁰.

Setup and licensing

Under the hood, the commercial plumbing is Google Cloud's own. Procurement happens in two moves: the subscription is purchased on a billing account²¹, and an admin then allocates its licenses by project and location²². Licenses stay bound to that project and location²³, just as the subscription stays bound to its billing account²⁴. Licenses can be assigned automatically or by hand²⁵. Seats can be committed monthly or annually²⁶, and a single subscription cannot exceed the seat cap that the Cloud console enforces²⁷. Before licenses go out, IAM has to be in order, since each recipient needs at least the Gemini Enterprise User role²⁸.

Business is simpler. Sign-up needs only a work email address²⁹, and there are neither project numbers nor project IAM roles to administer³⁰. Business, Standard and Plus each come with a 30-day free trial^31,32, and Plus can be trialed with no sales contact at all³³.

For a platform team already on Google Cloud, this setup will be familiar. For one that is not, the project, location and billing account model is a new layer to learn before the first agent runs.

Integrations

Out of the box, Business links to Google Workspace and to rivals' tools, Microsoft 365, HubSpot and Notion among them³⁴. On the enterprise side, the docs give four examples of third-party connectors that come prebuilt: ServiceNow, SharePoint, Jira and Confluence³⁵. Google's own suite is covered with live syncing of Gmail, Drive, Calendar and Groups³⁶. Analytics data can be reached through a federated connector to BigQuery³⁷.

Google does not publish a total connector count on the pages opened. The named list centers on documents, collaboration and IT service tools. Nexus publishes a figure above 4,000, spread over CRM, ERP, messaging and custom API connections³⁸.

Security and certifications

Google's certification list is long. The compliance documentation, scoped to Standard, Plus and Notebook Enterprise³⁹, is specific: its list runs from HIPAA and FedRAMP for regulated US work through the SOC family, ISO 27001 and payment-card standards⁴⁰. A team in a regulated US industry will find this the most direct answer here on HIPAA and FedRAMP.

Encryption controls are deep. Key control covers CMEK⁴¹, delivered through Cloud KMS on Standard and Plus⁴², with EKM and HSM-backed keys as further options⁴³. CMEK and Access Transparency are both unavailable when the global region is chosen⁴⁴, which makes region choice a security decision.

Google commits to keeping prompts, outputs and connected company data out of foundation model training⁴⁵, and to walling each customer's data inside its own Cloud project⁴⁶. Access is controlled by Cloud IAM⁴⁷, document-level access controls are enforced⁴⁸, and Model Armor is included in all editions⁴⁹. Prompt injection is handled by Model Armor, which screens both incoming prompts and tool output in real time⁵⁰. Where connectors reach outside Google, the advice is to authenticate them through Workforce Identity Federation⁵¹. Sensitive Data Protection, applied to connectors, prevents flagged data from entering the index in the first place⁵².

As a hosted service, the app gives customers no way to insert network controls of their own⁵³. Connectors to non-Google systems travel over the public internet to those systems' endpoints⁵⁴. Inside a VPC Service Controls perimeter, an org policy has to whitelist each Data Cloud connector⁵⁵; until it does, no data store can be created⁵⁶. In federated query mode, data in Data Cloud connectors stays where it is⁵⁷.

Governance

Governance is meant to be centralized, and the FAQ claims the app gives administrators one place to oversee agents across all teams⁵⁸. On the enterprise editions, administrators work through Cloud IAM, use Workforce Identity Federation for SSO, and rely on each source system's existing ACLs to decide what a user may see⁵⁹. Business-edition admins manage a shorter list: adding and removing members and deciding team access to connectors⁶⁰. Admins can cap consumption per user⁶¹.

On the developer platform, agents are treated as principals, each issued its own SPIFFE ID⁶² and protected out of the box by Context-Aware Access⁶³. Network control for agents is concentrated in Agent Gateway, the single entry and exit point the docs describe⁶⁴, which suits a security team that wants one place to inspect. Tool-use policy for agents is expressed as ordinary sentences instead of code⁶⁵. Sensitive Data Protection works across all editions⁶⁶.

That identity and gateway model is a strong foundation for a platform team that wants to run many agents under one policy. It does assume the team builds on Google's stack.

Region, retention and training

In the editions table, residency is offered in three settings, us, eu and global⁶⁷, and the FAQ confirms that Standard and Plus customers choose their region⁶⁸. The editions table lists Cloud Audit Logs and Access Transparency among the enterprise features, both useful to an audit team⁶⁹. The no-training rule holds across editions, for enterprise data⁷⁰ and for what Business users type and receive⁷¹. Business itself lives on the web at business.gemini.google⁷².

According to the security overview, data a user asks to remove is gone within 60 days⁷³. Capacity planning should treat storage and indexing as one pool per project and location, shared across users⁷⁴. Developer-side data gets the same protection: Google's zero-retention page promises the same for Agent Platform models, with training or fine-tuning ruled out absent prior permission or instruction from the customer⁷⁵. Some retention does apply, short-term storage for Models as a Service⁷⁶ and up to three days of logs when answers are grounded in Google Search⁷⁷, while logging of requests and responses stays off unless enabled⁷⁸. Data protection scanning works in the global region and in the EU and US multi-regions⁷⁹.

Pricing

Only Business has a list price, starting at 21 dollars per seat per month on its own page⁸⁰. The app's invoice is computed per seat each month, which means every person using it needs an active license⁸¹. We could not find a Standard or Plus seat price, which is not publicly stated on the pages we opened; the pricing link itself was broken on our check date⁸².

Developer usage is metered instead, charged as it is consumed⁸³. Release notes confirm that pay-as-you-go carries no license fee⁸⁴, and the licensing docs add that the bill arrives monthly for actual consumption⁸⁵. Calls to partner models are metered the same way⁸⁶, and online billing accounts can now prepay with credits⁸⁷. Notebook Enterprise has its own subscription route, with a ceiling of 5,000 licenses⁸⁸.

A platform leader costing a Google build therefore has three lines: app seats, Agent Platform consumption and the engineering time to build agents on it. Nexus removes that third line as a separate cost, since its charge per role automated already covers the consultants who build⁸⁹.

Stated limits

Daily allowances differ by edition, 160 assistant queries per license on Standard⁹⁰ against 200 on Plus⁹¹. Apart from storage and indexing, those quotas are shared across the users of an edition⁹². Customers counting on Gemini Code Assist should note the date it stops being bundled into existing Standard and Plus plans, March 31, 2027⁹³. The scanning has blind spots: a data store created the older way escapes the content rules, whether its source is a bucket, a BigQuery table or a website⁹⁴, and encrypted Office files pass through without a content scan⁹⁵.

Who it suits

Google aims the app at knowledge workers, naming the commercial, finance, people and technical departments as its main audience⁹⁶. Google's examples are everyday office work, such as a recap of last year's top campaigns⁹⁷, inventory tracking with automatic purchase orders⁹⁸, customer emails drafted with Search context⁹⁹, and new-hire onboarding through Notebook¹⁰⁰.

Build, buy or both on Google Cloud

The buy path is short. A team can open a Business edition account with a work email²⁹, pay from 21 dollars per seat per month⁸⁰ and try it free for 30 days³¹. Staff get search, assistants and a no-code agent workbench⁸ without a project to configure³⁰. For a group of up to 300 people¹⁶, that may be all that is needed.

The build path runs through the Agent Platform. It is billed on consumption⁸³, with partner model usage also pay-as-you-go⁸⁶. Your engineers write agents with ADK or the Agent Platform and publish them to the app¹², bring in agents from other stacks over A2A¹³, and govern them with an identity issued to each agent⁶², a single gateway⁶⁴ and tool rules written in plain words⁶⁵. That is a capable stack for a team prepared to build on it, and the work of designing, coding and maintaining each agent stays with that team.

Doing both is the pattern Google designs for: the app as the front door, the Agent Platform behind it, and partner agents from the marketplace in between¹¹. The cost has three parts, seats, consumption and engineering time, and only the first two appear on Google's bills.

A platform team should also plan for the network edges. Custom network controls cannot be added to the SaaS app⁵³. Any connector to a non-Google system will leave Google's network for a public endpoint⁵⁴. Teams inside a VPC Service Controls perimeter must allow-list Data Cloud connectors by org policy before any data store can exist^55,56. CMEK requires a specific region⁴⁴. Each is manageable, and each is a task for the platform team.

Nexus approaches the same estate from the other side. Its layer runs over the systems a company already has¹⁰¹, its model provider can be changed¹⁰², and its consultants assemble the first agent together with your staff, sparing your engineers that work⁸⁹. A company that wants Google models inside a cross-system workflow without staffing the build could run that workflow through Nexus and keep Gemini Enterprise for search and assistants.

Verdict

Gemini Enterprise is the right shortlist entry for an organization that already runs on Google Cloud and wants one place for search, assistants and custom agents. It has a long certification list, including HIPAA and FedRAMP⁴⁰, regional residency⁶⁷ and a well-defined agent identity model⁶². Sixth place reflects four things: two separate purchases³, no public price for Standard or Plus⁸², a named connector list weighted toward collaboration tools³⁵, and custom agents that your own engineers must still write on Google's stack. Nexus ranks above it for teams that want agents across many systems built with them, on a committed timeline⁸⁹.