DPIA — Google (Cloud infrastructure + voice AI)
Privacy Impact Assessment · Risk: LOW · Reviewed 2026-06-05
1. Vendor scope
| Managed relational database | Primary application database | northamerica-northeast1 (Montréal) |
| Managed object storage | Recordings, KB attachments, audio | northamerica-northeast1 (Montréal) |
| Managed serverless compute | Backend + frontend serving (no persistence) | northamerica-northeast1 (Montréal) |
| Google voice AI model (paid tier) | Real-time voice AI | Google global edge |
2. Categories of personal information
- Voice audio of caller (real-time stream to Google voice AI model)
- Transcripts derived from caller speech
- Caller-provided text (names, addresses, requests)
- Agent system prompts (may contain tenant-business context)
3. Legal basis (Loi 25 Art. 17)
Transfer outside Quebec is acceptable because:
- Google's Cloud DPA provides equivalent protection to Loi 25
- Data categories transferred are limited to what's strictly necessary
- All persistent storage (database, files, recordings) stays in Canada
- Google contractually prohibits training on customer data
- No human review without explicit organizational consent
4. Risk assessment
Overall: LOW. Standard practice for B2B voice AI on GCP.
- Unauthorized staff access: very low (Google internal controls + DPA prohibition)
- Training on customer data: negligible (explicit paid-tier exclusion)
- US subpoena: low (transparency reports available)
- Datacenter breach: very low (SOC 2, ISO 27001, FedRAMP certifications)
5. Retention at Google
- Managed database backups: 7 days
- Object storage: per tenant retention policy
- Google voice AI model requests/responses: brief abuse-detection logs only (days, not years)
- Build pipeline artifacts: 30 days
6. Conclusion
Google.s paid voice AI model + cloud infrastructure provides protection equivalent to Loi 25 requirements. Risk is LOW. Transfer is justified.
DPA reference: cloud.google.com/terms/data-processing-addendum