Hacker News Reader

Comment by Buge | Hacker News Reader

Google has to be able to read your emails, otherwise they wouldn't be able to index them for you to search through. Or do spam detection.

View on HN

If your company is using google apps, this would be one of the things of concern. How could you ensure none of your trade secrets are unintentionally leaking via meta data, etc... Unless every account is self-contained and isolated and encrypted at rest and they don't retain a master/admin key.

Leaking to whom?

I'll leave that up to your imagination. Additionally, imagine you have an email archive policy but occasionally you need to have some messages deleted, for compliance reasons, do they get deleted from all places they existed in google infrastructure? Are that henceforth irretrievable by google?

You should never assume this. If compliance and assurance that nobody can read your emails is important, you shouldn't be hosting them on Gmail.

Are there legitimate cases where compliance requires deleting materials? That sounds like compliance avoidance, not compliance itself.

If your legal tells you the legal from another entity wants their correspondence deleted, for some valid reason, you are compelled to carry that out.

At least in the US this is completely false and under some circumstances illegal.

There are legal-bounding reasons where you have to completely scrub data [0] [1]

[0]: https://en.wikipedia.org/wiki/Right_to_be_forgotten

[1]: https://en.wikipedia.org/wiki/Commission_nationale_de_l%27in...

Many corps operate 'compliance smoothing' in which materials are proactively deleted. Where I worked all e-mails were purged after 90 days unless the user manually saved them elsewhere.

Yes, HIPAA compliance strictly requires properly disposing of patient health information.

Google Apps even has specific services for companies needing HIPAA compliance: https://support.google.com/a/answer/3407054?hl=en

If the material includes sensitive personal information, privacy laws may require that the information be destroyed or "put beyond use" within a certain timeframe after the information is no longer necessary.

You might also, for example, have contractual obligations with another company to delete business confidential information after the end of the contract.

G Suite doesn't display ads or scan hosted data for advertising: https://gsuite.google.com/faq/security/

For sure there are arguments for scanning (threat detection/spam detection) but that has to be weighed against the meta data you are providing the provider, as well as knowing you are not in control of your data and someone else has a means to access the data, even if it's for learning purposes.

If you expect any privacy while using a corporate google apps suite you are misguided.

Endpoint security is an entirely different subject.

Reply on news.ycombinator.com