Glossary

#

2FA

2FA (Two-Factor Authentication) is a form of multi-factor authentication that combines exactly two different factors to sign in. Typically this is something you know (your password) plus something you have (a code from an authenticator app, a physical security key or an SMS code). The term is often used as a synonym for MFA, but strictly speaking 2FA is the specific case with exactly two factors, whereas MFA can require more. The goal is the same: ensuring that a leaked or guessed password alone does not grant access. In Google Workspace and on your personal Google account this is called 2-Step Verification, enabled through your security settings or by an administrator via the Admin Console.

A

Active Directory

Active Directory (AD) is Microsoft's directory service for centrally managing users, computers, groups and access rights within a Windows network. Administrators use it to handle credentials, policies and permissions from a single place, typically on an on-premises domain controller. This makes it the classic, self-hosted counterpart to cloud identity services. When moving to Google Workspace, Active Directory is often integrated or replaced: Google Cloud Directory Sync can synchronize users and groups from AD into Google, while SAML or federation keeps single sign-on possible. Microsoft's own cloud equivalent is now called Microsoft Entra ID, formerly Azure Active Directory.

ActiveSync

ActiveSync, formally Exchange ActiveSync (EAS), is a synchronization protocol from Microsoft that lets mobile devices keep email, calendar, contacts and tasks in sync with a mail server in real time. It is widely used on phones and tablets to keep an Exchange mailbox up to date everywhere, and it also gives administrators remote policy controls such as enforcing a passcode or wiping a lost device. Google supports the protocol through Google Workspace Sync, allowing devices that speak ActiveSync to synchronize with Gmail and Google Calendar as well. For modern Google environments, however, the native Gmail app or an account based on modern authentication is generally recommended.

Admin Console

The Admin Console is the central management environment for Google Workspace, reached at admin.google.com, where administrators run the organization's entire account. From this console you create users and groups, assign licenses, manage devices and configure security and policy settings such as two-step verification, data regions and app access. Settings can apply to the whole organization or be refined per organizational unit, so different departments get different rules. The console also provides reports and logs on usage and security. Access is tied to administrator roles, ensuring that only authorized people can make changes.

Agentic AI

Agentic AI refers to AI systems that do more than answer a question: they autonomously pursue a goal by planning and executing multiple steps, making decisions and using tools along the way. Such an agent might break a task into parts, consult external sources, evaluate intermediate results and adjust its approach until the goal is reached. This goes beyond a single prompt-and-answer interaction and relies on capabilities such as memory, function calling and grounding. Within Google Cloud you can build agents with Vertex AI and its agent tooling that perform actions in systems like Google Workspace, provided they are well scoped with clear guardrails and access control.

AI-agent

An AI agent is an AI system that works towards a goal on its own rather than just answering a single question. The agent reasons about what is needed, plans intermediate steps, calls external tools or data sources and uses the results to decide its next move. For example, an agent might check a calendar, look up a document and then draft an email, all within one assignment. What sets it apart from an ordinary chatbot is its degree of autonomy and its ability to act, not merely talk. In the context of Google Workspace and Google Cloud, agents are used to automate multi-step tasks, where human oversight and a clear scoping of permissions remain important.

Air-gapped

Air-gapped describes a system that is physically fully disconnected from every network, including the internet and other internal networks. Because of that literal air gap the system cannot be reached remotely, making it one of the strongest security measures against external attacks. It is used for highly sensitive environments such as industrial control systems, classified data or critical backups, where the risk of a breach is unacceptable. The downside is a sharp loss of convenience: data and updates must be brought in manually and under control, for example via removable media, which is slower and can itself become an attack path. An air gap does not eliminate risk entirely, but it reduces it considerably.

Alert Center

The Alert Center is the alerting hub of Google Workspace, a dashboard in the Admin Console where security and administrative notifications about the organization come together. It consolidates signals such as suspicious sign-ins, user-reported phishing, malware in Gmail, leaked passwords and configuration changes, so administrators do not have to monitor each source separately. Each alert shows details and context, and teams can open an investigation, assign a status or take follow-up actions. In this way the Alert Center helps organizations spot and respond to incidents faster. Combined with investigation tools and rules, it forms an important part of security management within Workspace.

Ansible

Ansible is an open-source automation tool for configuring servers, deploying software and managing entire IT environments through human-readable scripts. These scripts, called playbooks, are written in YAML and describe the desired end state of a system rather than a list of individual commands. Ansible is agentless: it needs no extra software running on the target machines because it connects over SSH, which makes it quick to adopt and easy to reason about. In a Google Cloud context, Ansible is often used to provision Compute Engine VMs after creation, install packages and keep configuration consistent across many machines. It complements an infrastructure-as-code workflow well, with Terraform building the infrastructure and Ansible configuring the software that runs on it.

API

An API (Application Programming Interface) is a defined set of agreements that lets software components communicate without knowing each other's internal workings. The API describes which requests you can make, which data you send with them and what response you get back, so that one application can use another's functionality or data. On the web, APIs often run over HTTP, for example as REST or GraphQL interfaces that exchange JSON. APIs are the backbone of modern integrations: Google offers many, such as the Gmail, Drive and Admin SDK APIs and the Google Cloud and Gemini APIs, letting you automate workflows, connect services and embed AI capabilities in your own applications. Access is typically secured with keys or OAuth.

App Access Control

App Access Control is the Google Workspace feature that lets administrators decide which third-party apps may access the organization's data through Google accounts. When a user signs in to an external app with their Workspace account, or that app requests permissions to Gmail, Drive or Calendar, for example, the administrator can set per app whether access is allowed, blocked or limited. This prevents unknown or risky apps from silently reaching company data. It is an important safeguard against data leaks and over-broad OAuth grants, and it supports a Zero Trust approach in which access is granted deliberately and sparingly.

App Password

An App Password is a special, one-off sixteen-character password that lets an older application or device sign in to your Google account while 2-Step Verification is enabled. It is meant for apps that do not support the modern, secure sign-in method (OAuth) and therefore cannot handle the second factor, such as some legacy mail programs. You create it in your Google account's security settings and use it instead of your regular password; you can revoke it again at any time. Because an App Password bypasses the second factor, it is less secure. Google advises avoiding it and switching, where possible, to apps that support OAuth.

Apps Script

Apps Script is Google's JavaScript platform for automating tasks and extending Google Workspace. You write small scripts that talk directly to services such as Gmail, Sheets, Docs, Drive, and Calendar, for example to send emails automatically, move data between spreadsheets, or build a recurring report. Scripts run on Google's servers, so you don't need your own server, and they can be started on a schedule or by an event using triggers. You can also use it to create menu items, sidebars, and even complete web apps. It is an accessible way for admins and advanced users to add custom functionality without a heavy development environment.

AppSheet

AppSheet is Google's no-code platform for building apps without programming. You connect a data source, such as Google Sheets, a database, or other systems, and AppSheet automatically derives a working app from it, complete with forms, lists, and views. You then configure the logic through settings: validation rules, automated actions, notifications, and workflows. The apps run on phone, tablet, and in the browser, and can work offline. It is meant to let departments and non-technical staff within Workspace build their own solutions, for example for inventory management, inspections, or requests, without needing a dedicated development team.

ARC

ARC stands for Authenticated Received Chain and solves a well-known problem with forwarded email. When a message passes through an intermediary such as a mailing list or forwarder, the content is often modified slightly, for example with a subject prefix or a footer, which breaks the original DKIM signature and causes the DMARC check to fail at the final recipient. ARC preserves the original authentication result in a chain of headers, so each intermediary can record that the mail was correctly verified on arrival. The final recipient can trust that chain when the intermediaries are reputable, and thereby still accept legitimate forwarded mail. Gmail and Google Workspace actively use ARC when evaluating forwarded messages.

Archive

Archiving means moving a message or file out of your active view without deleting it. In Gmail an archived message disappears from the Inbox but is fully retained and searchable under All Mail, and it reappears the moment someone replies. This keeps your inbox tidy while nothing is actually lost. It differs from deleting, where a message goes to Trash and is permanently removed after a retention period. More broadly in Workspace, archiving is also used to keep data available for long-term reference or compliance, separate from your day-to-day workspace.

Artifact

An artifact is a file produced by a build process that you store for later deployment, such as an executable, a compiled library, a package, or a container image. It is the tangible result that emerges from source code and that subsequent steps test, distribute, and put into production. By keeping artifacts centrally with a version number, you avoid rebuilding for every deployment and track exactly which version runs where. In Google Cloud, Artifact Registry provides this storage for container images and language packages among other formats, with access control and integration into the build and deploy pipeline. From a security standpoint it is important to scan artifacts for vulnerabilities and be able to prove their provenance before releasing them.

Attachment

An attachment is a file you add to an email message, such as a document, image, PDF or spreadsheet, so the recipient receives it together with your message. Gmail enforces a maximum message size, so large files are automatically sent as a Google Drive link instead of a true attachment, which also helps collaboration because everyone sees the same version. Attachments are a common vector for malware and phishing, so Gmail scans them for viruses and blocks certain executable file types. Always be cautious with attachments from unknown senders.

Audit Log

An audit log is a chronological record of activities and changes within a system or organization, such as sign-ins, shared files, modified settings or admin actions. In Google Workspace these logs live in the Admin console under Reports and the Audit logs, letting administrators trace who did what and when. They are essential for security, investigating incidents and demonstrating compliance, because they capture a reliable trail of actions. Logs can also be exported to BigQuery for deeper analysis and long-term retention.

Auto-Reply

An auto-reply is a preset message the system sends back automatically to people who email you, so you do not have to respond manually each time. In Gmail this is known as the vacation responder, which you enable for a chosen period and can optionally limit to your contacts or to people within your organization. It is useful during holidays or leave to let senders know you are unavailable and whom to contact in the meantime. Gmail typically sends such a reply only once per sender within a given window, to avoid flooding anyone with repeated messages.

Autoscaling

Autoscaling is the automatic scaling up and down of the number of servers, containers or function instances based on current load. Instead of fixing a static amount of capacity in advance, the system adds capacity as demand rises and removes it again as activity subsides. Scaling thresholds are usually driven by signals such as CPU usage, memory, requests per second or queue length. The goal is twofold: maintaining performance during peak moments and avoiding unnecessary cost during quiet periods, since in the cloud you pay only for what you use. In Google Cloud, services such as managed instance groups, Cloud Run and GKE offer built-in autoscaling, with Cloud Run able to scale all the way down to zero when there is no traffic.

B

Backscatter

Backscatter is a flood of unwanted error messages you receive because a spammer or piece of malware forged your email address as the sender. When those messages are sent to non-existent mailboxes, the receiving mail servers generate a non-delivery notice, but instead of reaching the real sender it lands in your inbox, the innocent victim whose address was spoofed. The result is a mailbox full of bounces for mail you never sent, and in the worst case damage to your domain's reputation. Strong sender authentication through SPF, DKIM and DMARC reduces backscatter, because receiving servers can recognise forged senders earlier and reject the message outright rather than producing a bounce afterwards.

Backup

A backup is a copy of data you keep so you can restore it after loss, corruption, accidental deletion or a ransomware attack. A solid backup strategy often follows the 3-2-1 rule: multiple copies, on different media, with at least one kept offsite. While Google Workspace stores data redundantly across its data centers, that does not protect against a user accidentally deleting something, so many organizations add dedicated backups of Gmail, Drive and other services through tools like Google Vault or third-party backup solutions. Test your restores regularly, because a backup you can never restore is worthless.

Backup Code

A Backup Code is a pre-generated emergency code that lets you sign in to an account when your usual two-step verification is unavailable, for example if you lose your phone or have no connection. Google typically provides a set of ten codes that you store securely, separate from your phone, and each code works only once. They act as a safety net so you are not locked out when your security key or authenticator app is out of reach. Within Google Workspace, users can generate codes themselves, and an administrator can create or revoke them in the Admin Console for accounts that have been locked out.

Bandwidth

Bandwidth is the maximum amount of data that can be transferred over a network connection within a given time, usually expressed in bits per second such as Mbps or Gbps. It influences how quickly large files upload or download and how many simultaneous connections stay responsive, for example during Google Meet video calls or Drive synchronization. Bandwidth is often confused with speed, but it is closer to the capacity of the pipe: more bandwidth lets more data through at once, while latency describes how long a packet takes to travel. With many concurrent users, limited bandwidth can become a bottleneck.

Base64

Base64 is an encoding scheme that turns binary data into ordinary, readable text built from a fixed set of 64 characters: letters, digits, and a few symbols. Its purpose is not security but safe transport: by representing bytes as text, data can pass safely through systems that handle only text, such as email or JSON. Base64 is therefore not encryption and offers no secrecy; anyone can reverse it. The encoding makes the data roughly a third larger. You encounter Base64 often, for example in email attachments, in images embedded directly in HTML or CSS through data URIs, and as part of JSON Web Tokens. In Google Cloud, some APIs deliver binary fields, such as file contents, in Base64.

Basisauthenticatie

Basic Authentication is an outdated login method in which only a username and password are sent to gain access to a service or API. Because there is no additional security layer and the credentials are transmitted with every request, the method is vulnerable to interception, phishing and automated attacks. For this reason Basic Authentication is being widely phased out in favor of OAuth tokens and multi-factor authentication (MFA), which are far more resistant to password theft. Google has discontinued password-only access for so-called less secure apps, and modern integrations with Google Workspace run through OAuth 2.0. Disabling Basic Authentication is an important step in securing an email environment.

Bastion host

A bastion host is a hardened intermediate server that serves as a controlled gateway to protected internal systems. Instead of exposing private servers directly to the internet, administrators route all their management traffic through this single, closely monitored machine. The bastion host is deliberately kept minimal, runs only what is strictly necessary, and is heavily monitored and logged, so the attack surface stays small and all access is traceable. This keeps sensitive systems hidden inside a private network while still allowing administration. In Google Cloud you can implement this pattern with a VM in a private network, but the modern and more secure variant is Identity-Aware Proxy with IAP tunneling, which grants management access without public IP addresses and with per-user identity verification.

Beheerde Google Play

Managed Google Play is the enterprise version of the Play Store, aimed at organizations that centrally manage Android devices through mobile device management or Google Endpoint Management. Instead of letting employees install apps freely, administrators decide which apps are available: they approve apps, distribute them to selected devices or groups, and can also publish private, internally developed apps exclusively within their own organization. On a corporate device, the user then sees a curated store containing only the permitted apps. This keeps an organization in control of what software runs on company devices, which helps with security, license management and compliance with internal policy. Managed Google Play is a core part of Android Enterprise management within Workspace.

BigQuery

Google BigQuery is the serverless, fully managed data warehouse of Google Cloud, built to analyze enormous volumes of data quickly using familiar SQL. Because storage and compute are separated and queries are automatically distributed across many machines, you can scan terabytes to petabytes without managing or scaling servers yourself. You typically pay for the amount of data processed or for reserved capacity. BigQuery is popular for business intelligence, log and event analysis and combining data from multiple sources, and integrates with tools like Looker Studio, Dataflow and built-in machine learning through BigQuery ML.

BIMI

BIMI (Brand Indicators for Message Identification) is a standard that displays your verified brand logo next to your emails in the inbox of supporting providers. Its purpose is twofold: recipients recognize legitimate messages faster, and it becomes harder for phishers to impersonate your brand. BIMI builds on email authentication: a sending domain must first have SPF, DKIM and a strict DMARC policy (quarantine or reject) configured correctly before the logo appears. The logo is published as a specially formatted SVG file, and some inboxes additionally require a Verified Mark Certificate (VMC) that confirms brand ownership. Gmail supports BIMI, so well-configured Workspace domains can show their logo alongside outgoing mail.

Blue team

The blue team is an organization's defensive security team. It monitors systems, detects suspicious activity, responds to incidents and continuously hardens defenses against attacks. It is the counterpart to the red team, which tests offensively by simulating real attacks. In a structured exercise the two work together: the red team attacks while the blue team defends and learns from every attempt. In a Google Workspace or Google Cloud setting a blue team relies heavily on logging and monitoring, for example the security investigation tool in the Admin console, Cloud Logging and Security Command Center, to spot and stop attacks in time.

Blue-green deployment

Blue-green deployment is a release strategy that reduces downtime and risk by running two identical production environments side by side: blue (the current, live one) and green (the new version). Users stay on blue while green receives the new release and is tested thoroughly. Once green is verified, you switch all traffic over at once, typically through a load balancer or DNS change. If something goes wrong, you redirect traffic back to blue just as quickly, giving you an almost instant rollback. On Google Cloud you can build this with a load balancer fronting multiple instance groups, or with Cloud Run, which can split traffic between revisions. It costs more resources because two environments run temporarily, but it delivers safe and reversible deployments.

Bounce

A bounce is an automatic return message from a mail server indicating that an email could not be delivered. The notice usually includes a reason, such as an unknown or misspelled address, a full mailbox, or a server that refuses the message. A distinction is made between a hard bounce, a permanent failure such as a non-existent address, and a soft bounce, a temporary failure such as a server that is briefly overloaded. Bounces matter for keeping your mailing lists clean, because continuing to send to addresses that hard bounce harms your sender reputation. In Gmail and Google Workspace you often see the cause in a return message from the mailer-daemon containing an SMTP error code that helps you pinpoint the problem.

Browser Policy

A browser policy is a set of management settings with which an organization centrally controls how Chrome or another browser behaves on employee devices. Think of enforcing secure settings, managing allowed extensions, locking the home page, blocking certain sites or requiring updates. In a Google Workspace or Chrome Enterprise environment these policies are rolled out through the Admin console and tied to organizational units, so different departments get appropriate rules. Browser policy is an important part of both security and compliance, because the browser is often the primary gateway to company data.

Brute force

A brute-force attack systematically tries every possible password, key or code until the correct one is found. The method requires no knowledge of a vulnerability, only raw computing power and time, and is often accelerated with wordlists or common combinations. The longer and more random a password or key, the more attempts are needed and the more impractical the attack becomes. Defenses include strong, long passwords, rate limiting of login attempts, account lockout and especially two-step verification. In Google Workspace, features such as enforced 2-step verification and passkeys make brute-force attempts against accounts virtually hopeless.

C

Calendar Resource

A calendar resource is a shared facility, such as a meeting room, a projector, a pool car or another device, that can be booked in Google Calendar. Administrators create these resources in the Admin console, often grouped by building, floor and category so they appear in the building hierarchy. When scheduling an event, employees add the desired room or device as a guest, after which Calendar tracks whether it is free at that time and helps prevent double bookings. Well-defined resources with capacity and features make finding a suitable room considerably easier.

Canary release

A canary release is a gradual rollout method in which a new version is first shown to a small portion of users, for example five percent, before everyone receives it. The name refers to the canary in the coal mine: by exposing a small group first, you detect bugs, performance regressions or rising error rates before they affect the entire user base. If the small group performs well, you increase the percentage step by step toward one hundred percent; if problems appear, you roll back with minimal impact. On Google Cloud, Cloud Run supports this directly by letting you assign a percentage of traffic to a new revision, and GKE and the load balancers enable canary rollouts as well. It is a safer alternative to releasing to everyone at once.

CAPTCHA

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart and is a verification mechanism meant to determine whether a real person is behind an action rather than an automated script. It is used on login pages, sign-up forms and contact forms to curb spam, abuse and automated attacks. Classic variants show distorted text or image puzzles, while more modern solutions like Google reCAPTCHA work largely invisibly by analyzing behavior and signals, so the user usually has to do nothing. CAPTCHA raises the barrier for bots, but is not complete security on its own.

Catch-All

A catch-all is a mailbox or rule that captures all email sent to addresses within a domain that do not otherwise exist, for example a typo or a made-up name. This way no message is lost with a 'user does not exist' error. In Google Workspace you configure this through the routing settings in the Admin console. It is a double-edged sword, however: a catch-all also collects a lot of spam and signals to spammers that any random address appears valid, which can increase the volume of unwanted mail. Many administrators therefore prefer explicit aliases or let unknown addresses bounce cleanly.

CDN

CDN stands for Content Delivery Network, a worldwide network of servers that stores and delivers content such as images, videos, scripts, and entire web pages close to the visitor. Instead of routing every request all the way back to the origin server, a nearby edge server serves the visitor, so pages load faster and the distance data has to travel shrinks. This lowers latency, relieves the main server, and absorbs traffic spikes. A CDN also improves availability and helps mitigate certain attacks by spreading traffic out. Google Cloud offers Cloud CDN for this purpose, which uses Google's global edge network to deliver static and cacheable content quickly to users around the world.

Chain-of-thought

Chain-of-thought is an approach where you ask a language model to write out its reasoning step by step before arriving at a final answer. By having it articulate intermediate steps, the model usually performs better on complex tasks such as arithmetic, logic and multi-step reasoning, because the problem is solved in manageable parts rather than all at once. You often trigger this with a simple instruction like think step by step, or with examples that demonstrate the reasoning. In user-facing applications you sometimes choose to generate the intermediate steps internally but not display them. Modern models, including Gemini in Google Cloud, benefit from this technique for more accurate outcomes.

Checksum

A checksum is a short verification value computed from the contents of a file or message using a fixed algorithm. By comparing the checksum at the source with the checksum after transfer or storage, you can determine whether the data was corrupted or altered along the way: as soon as even a single bit changes, the result comes out differently. Simple variants such as CRC are aimed mainly at catching accidental errors, while cryptographic hashes like SHA-256 also make deliberate tampering far harder. In the context of Google Cloud, checksums are used automatically when storing and downloading objects in Cloud Storage, so you can verify that an upload or download arrived complete and intact.

Chrome Enterprise

Chrome Enterprise is the business management environment with which organizations can centrally deploy, secure and manage Chrome browsers and ChromeOS devices. Through the Google Admin console, administrators set policies for hundreds of settings, manage extensions, enforce updates and security measures, and tie rules to organizational units. It covers both cloud management of the Chrome browser on Windows, Mac and Linux and the management of Chromebooks and kiosks. Chrome Enterprise focuses on secure, manageable access to web applications and company data, and integrates closely with Google Workspace and with zero-trust approaches like BeyondCorp.

Chrome Policy

Chrome Policy refers to the settings administrators use to configure managed Chrome browsers and ChromeOS devices centrally, typically from the Google Workspace Admin Console. With it you define how Chrome behaves for users: think of allowed or blocked extensions, the home page, updates, security features such as Safe Browsing, and which websites are reachable. Policies can apply per user or per device and be refined per organizational unit, so different groups receive different rules. This lets an organization keep control over the browser as a work environment and enforce security and compliance without setting up every machine by hand.

CI/CD

CI/CD stands for Continuous Integration and Continuous Delivery (or Deployment), an approach in which testing and releasing software changes is largely automated. With Continuous Integration, developers merge their code into a shared codebase frequently, after which automated tests immediately check that everything still works and surface bugs early. Continuous Delivery extends this so that every successful change is automatically prepared for release, and with Continuous Deployment the change even goes to production without a manual step. The result is that teams ship new features and fixes faster, more often, and with less risk. On Google Cloud, services such as Cloud Build and Cloud Deploy support setting up these automated pipelines.

CI/CD-pipeline

A CI/CD pipeline is an automated chain of steps that tests, builds and deploys software changes, so adjustments reach production quickly and reliably. The CI side, continuous integration, automatically runs tests and builds an artifact such as a container image on every code change, surfacing errors early. The CD side, continuous delivery or deployment, takes that artifact and promotes it in a controlled way to test and production environments. Automating these steps reduces the risk of human error and shortens the time from idea to going live. From a security standpoint, vulnerability scans and approval gates are often included in the pipeline as well. In Google Cloud, Cloud Build plays a central role here.

CIDR

CIDR stands for Classless Inter-Domain Routing and is the modern way to express ranges of IP addresses compactly. A notation such as 192.168.1.0/24 consists of a network address followed by a prefix length; the /24 indicates that the first 24 bits identify the network and the remaining 8 bits are available for hosts, here 256 addresses. CIDR replaced the old rigid system of class A, B, and C networks and allows far more flexible use of address space. You encounter the notation when configuring subnets, firewall rules, and VPNs. In Google Cloud, when you create a VPC subnet or a firewall rule, you almost always specify the IP range in CIDR notation.

Client-side encryption (CSE)

Client-side encryption, abbreviated CSE, is a form of encryption in Google Workspace where data is encrypted on the user's device before it is sent to Google. The defining difference from standard encryption is that Google does not manage the encryption keys; those are held by an external key management service that the organization chooses and controls itself. As a result, Google only sees unreadable data, and the organization retains control over who can decrypt. CSE is available for services such as Drive, Docs, Gmail, Calendar, and Meet, and is aimed mainly at organizations with strict requirements around confidentiality, compliance, or data governance. It does require extra configuration and a connected key provider.

Cloud Armor

Cloud Armor is Google Cloud's security service that protects your web applications and APIs against DDoS attacks and malicious traffic. It operates at the edge of Google's network, typically attached to an external load balancer, filtering out unwanted requests before they ever reach your servers. Using security policies you define rules based on things like IP address, geographic origin or patterns that indicate an attack, while built-in WAF rules help defend against common vulnerabilities such as SQL injection and cross-site scripting. This keeps legitimate traffic flowing while attacks are blocked before they cause damage or run up extra costs.

Cloud CDN

Cloud CDN is Google Cloud's content delivery network that stores and serves your content from servers around the world, close to your visitors. Instead of routing every request all the way back to your origin server, Cloud CDN keeps copies of static files such as images, videos, scripts and stylesheets in caches at hundreds of edge locations. The result is faster page loads, less load on your backend and lower egress costs from your own server. Cloud CDN integrates with Google Cloud's external load balancing and uses the same global network, so with just a few settings you achieve substantially better load times for a worldwide audience.

Cloud DNS

Cloud DNS is Google Cloud's managed Domain Name System service that lets you publish DNS zones and records on the same global network of name servers Google relies on internally. It translates domain names into IP addresses and supports both public zones, reachable from the open internet, and private zones that resolve only inside your Virtual Private Cloud. Because the service runs on anycast name servers distributed worldwide, visitors are answered from a location near them, keeping lookups fast and highly available. Cloud DNS is fully programmable through its API, the gcloud CLI and Terraform, and is billed per managed zone and per million queries, making it easy to manage your naming infrastructure as code.

Cloud Functions

Cloud Functions is the serverless service of Google Cloud that lets you run small, self-contained pieces of code in response to an event or an HTTP request, without having to manage a server. Think of code that fires when a file is uploaded to Cloud Storage, a message arrives in Pub/Sub, or an endpoint is called. The service scales up and down automatically with the number of events, and you typically pay only for the time your code actually runs. It fits well in an event-driven architecture where individual functions handle specific tasks, such as processing uploads, sending notifications or gluing services together. The newer generation is offered by Google under the name Cloud Run functions.

Cloud Identity

Cloud Identity is Google's standalone service for identity, access and device management (IAM and endpoint management) that you can adopt without subscribing to the Workspace productivity apps. Administrators use it to create user accounts and groups, enforce two-step verification and password policies, and control through the Admin console which devices may reach company data. It acts as a central identity source that provides single sign-on (SSO) to thousands of third-party cloud applications and can federate with external identity providers over SAML or OIDC. In practice Cloud Identity is the identity layer beneath Google Workspace and Google Cloud, and it comes in both a free edition and a Premium edition with richer device and security capabilities.

Cloud Run

Cloud Run is a fully managed platform on Google Cloud for running containers that scale automatically with traffic, including scaling all the way down to zero when there are no requests. You supply a container image or source code and do not have to manage servers, clusters or operating systems; Google handles the underlying infrastructure and security. You typically pay only for the actual execution time, which makes it attractive for web applications, APIs and background tasks with variable load. Because it runs standard containers, you can use almost any language or framework. Scaling to zero saves money during quiet periods, but a fresh spike can incur a brief cold start while an instance is brought up.

Cloud Search

Cloud Search is the Google Workspace search service that searches across your work environment at once, including Gmail, Drive, Calendar, Docs, and Contacts. Instead of searching each app separately, a central search bar returns relevant results from all your content, ranked by what is likely most important to you. Only items you already have access to are shown, so existing permissions continue to apply. Cloud Search is available in certain Workspace editions and, with additional capabilities, can also make business data from third-party systems searchable. It saves time by making information easier to find across multiple services.

Cloud SQL

Cloud SQL is the fully managed relational database service of Google Cloud for MySQL, PostgreSQL and SQL Server. Google takes the operational burden off your hands, including installing and updating the database, creating backups, applying patches and providing high availability through replication to a second zone. This lets you use a familiar SQL database without maintaining servers yourself, while your application connects through standard database connections. For security there are features such as encryption, private network access and fine-grained access permissions. Cloud SQL suits classic transactional applications and web applications; for very large or globally distributed workloads, Google additionally offers heavier-duty options.

Cloud Storage bucket

A Cloud Storage bucket is a storage container in Google Cloud in which you keep files and objects, from a single small file to petabytes of data. A bucket has a globally unique name, and when you create it you choose a location and a storage class, so you can store frequently used data and rarely accessed or archival data at appropriate cost. Objects are addressed by a key and can be given versioning, lifecycle rules and fine-grained access permissions through IAM. Buckets are widely used for backups, media, datasets, log files and as storage behind web and application environments. The data is stored durably and, depending on the chosen location, spread across multiple zones or regions for better availability.

Cold start

A cold start is the extra latency that occurs when a scalable service has to start from zero before it can handle the first request. On serverless and highly elastic platforms, instances are scaled down when there is no traffic; when a new request then arrives, an environment must first be created, the container or runtime loaded and the application code initialised. The user experiences that startup time as a one-off delay on the first request, while subsequent requests to an already running, warm instance are fast again. In Google Cloud this is relevant for Cloud Run and Cloud Functions, where you can limit cold starts by keeping minimum instances warm, keeping the container small and avoiding heavy initialisation work.

Compliance Rule

A compliance rule is an administrator-defined condition that automatically governs how data or communication is handled so the organization meets legal, contractual or internal requirements. In Google Workspace you configure such rules in the Admin console, for example to block, quarantine or encrypt outbound email that contains sensitive content, or to archive messages and files according to a retention period. A rule typically pairs a trigger or condition (such as a keyword, a pattern or a recipient domain) with an action that is then carried out. In this way compliance rules help organizations consistently satisfy frameworks like the GDPR, HIPAA or sector-specific obligations, without relying on employees to enforce them by hand.

Compute Engine

Compute Engine is the Infrastructure-as-a-Service offering of Google Cloud that lets you run virtual machines on Google's global infrastructure. You choose the machine type, the amount of CPU and memory, the disks and the operating system, and you retain full control over the OS and the software running on it. That makes it the most flexible compute option in Google Cloud, suitable for both standard servers and demanding or specialized workloads, optionally with GPUs. With features such as managed instance groups and autoscaling you can let capacity grow with demand, and with options like cost-effective spot VMs you can reduce spending. Compute Engine often serves as the foundation for migrating existing servers to the cloud.

Confidential Mode

Confidential Mode is a Gmail feature for sending sensitive messages with added restrictions. The sender sets an expiration date after which the content becomes unreadable, and can optionally require an SMS passcode before the recipient can open the message. Options to forward, copy, print or download the content are disabled as well. The message stays on Google's servers; recipients see a link or an embedded view rather than the raw email. Confidential Mode reduces accidental sharing, but it is not full end-to-end encryption: a determined recipient can still take a screenshot. In Google Workspace, administrators can enforce or block its use across the organization.

Contact Sharing

Contact Sharing is the Google Workspace setting that determines whether employees' address details are visible to one another within the organization through the shared directory. When it is on, users can easily find each other in Gmail, Calendar and Contacts via the company-wide directory, which makes collaborating and emailing simpler. Administrators configure this from the Admin Console and can choose which profile fields are shared and whether external domain profiles are included. Organizations that weigh privacy more heavily, or that host multiple clients in one environment, may instead restrict contact sharing. This concerns the organization-wide directory, not the personal contact lists that users share themselves.

Container

A container is a lightweight, isolated package of an application together with everything it needs to run: code, runtime, libraries, and settings. Because those dependencies are bundled in, the application runs the same everywhere, whether on a laptop, a test server, or in the cloud, which largely solves the notorious it works on my machine problem. Unlike a virtual machine, a container shares the host operating system kernel, which makes it faster and more efficient. Containers are the foundation of modern software; in Google Cloud you can run them on Cloud Run, for example, or manage them at larger scale with Kubernetes via GKE.

Container registry

A container registry is a repository where container images are stored, versioned and shared, so that servers and deployment processes can pull them to run applications. It works much like a software library: after building, you push an image to the registry, and during a deployment the target environment pulls exactly the version you want via a tag. Registries can be public, such as Docker Hub, or private and restricted to an organisation. From a security standpoint, a private registry with access control and scanning of images for known vulnerabilities matters. Within Google Cloud, Artifact Registry fills this role and integrates directly with services such as Cloud Run and Google Kubernetes Engine.

Context caching

Context caching is a technique where a large language model retains a fixed, frequently reused input across requests, so that context does not have to be fully reprocessed on every call. Think of a long document, an extensive system instruction or a knowledge file that you send each time: instead of reprocessing those tokens repeatedly, the preprocessed representation is cached and reused. This lowers both the cost and the latency of follow-up queries, because only the new input still needs to be processed. In Google Cloud, the Gemini API offers context caching, which is especially valuable for chatbots, document analysis and agents that repeatedly rely on the same background information.

Context Window

The context window is the maximum amount of text, measured in tokens, that a language model can process at once. It covers both the input, meaning your prompt plus any documents and conversation history you provide, and the answer the model generates. If the information does not fit within that window, the oldest or surplus part is dropped and the model can lose track of the context. The size varies considerably by model: modern models such as Gemini offer very large context windows holding hundreds of thousands to more than a million tokens, letting you supply entire reports or codebases at once. The context window is therefore a practical limit: the larger the window, the more background the model can take into account, although large inputs also cost more compute and time.

Context-Aware Access

Context-Aware Access is an access model within Google Cloud and Google Workspace that evaluates each request to decide whether a user is granted access, based on the context of that request rather than a valid password alone. Alongside the user's identity it weighs signals such as the IP address or geographic location, the security posture and type of the device, and an assessed risk score. Administrators define access levels and rules so they can, for instance, require that sensitive apps are reachable only from a managed, encrypted corporate device located in a specific country. This principle is a cornerstone of a zero-trust approach, where trust is established continuously and contextually instead of just once at sign-in.

Cron-expressie

A cron expression is a short, structured notation that specifies the times at which a task should run automatically. The expression typically consists of fields for minute, hour, day of month, month, and day of week, where an asterisk stands for every possible value. Thus 0 0 * * * means every day at midnight, and 0 9 * * 1 means every Monday at nine o'clock. Cron expressions have been the standard for scheduling recurring tasks on Unix-like systems and in countless schedulers for decades. In Google Cloud you use this notation in Cloud Scheduler and App Engine cron jobs, for example to run backups, reports, or cleanup actions at fixed moments.

CSRF

CSRF stands for Cross-Site Request Forgery. It is an attack in which a malicious site or email abuses the browser of a logged-in user to silently perform an action on another site where that user already has a valid session. Because the browser automatically attaches cookies, the request looks legitimate to the target site. Examples include silently changing a password, triggering a payment, or altering account settings. The standard defences are anti-CSRF tokens that are unique per session or per form, checking the Origin or Referer header, and setting the SameSite attribute on cookies so they are not sent from third-party sites.

CSV

CSV stands for Comma-Separated Values and is a simple, plain-text file format for storing tabular data: each line is a row and the fields within that row are separated by a delimiter, usually a comma or semicolon. Because the format carries no styling, formulas or multiple tabs, it is lightweight and readable by virtually any program. In the context of Google Workspace and Google Cloud, CSV is widely used to import and export data, for example to create users in bulk through the Admin console, migrate contact lists, or move data between Google Sheets, BigQuery and other systems. When using it, mind the correct character encoding (ideally UTF-8) so that special characters and diacritics are preserved.

Custom Role

A custom role is an administrator-built set of permissions that lets you define precisely which administrative tasks someone may and may not perform. Instead of granting a broad, predefined role, you select exactly the privileges that match a job function, applying the principle of least privilege. In the Google Workspace Admin console you might create a help-desk role allowed only to reset passwords, while in Google Cloud IAM you assemble roles from individual permissions to scope access to specific resources. Custom roles reduce the attack surface and make responsibilities clearer, because each administrator holds only the access strictly required for their work.

CVE

CVE stands for Common Vulnerabilities and Exposures. It is a globally used system that assigns a unique identifier to each publicly known security flaw, in the form CVE-year-sequence. Thanks to this number, vendors, researchers, administrators, and security tools can refer unambiguously to exactly the same flaw, without confusion over names or descriptions. A CVE entry briefly describes the vulnerability and the affected products, but does not provide a severity score; CVSS is commonly used for that. The programme is coordinated by MITRE with support from many organisations that may act as numbering authorities. In practice the CVE identifier is the common language of vulnerability management, patch advisories, and security bulletins.

CVE-patch

A CVE patch is a software update that specifically fixes a known, publicly recorded security flaw. CVE stands for Common Vulnerabilities and Exposures, an international system that assigns every published vulnerability a unique identifier so that vendors, administrators and researchers can refer to the same issue unambiguously. Once a CVE becomes public, the risk of exploitation rises quickly because attackers know the details. Installing the corresponding patch promptly is therefore critical and lies at the heart of patch management. In cloud environments managed services are often updated automatically by the provider, while self-managed systems require active follow-up.

CVSS

CVSS stands for Common Vulnerability Scoring System. It is an open standard that expresses the severity of a security flaw as a number from 0.0 to 10.0, where higher means more severe. The score is derived from characteristics such as the attack vector, complexity, required privileges, and the impact on confidentiality, integrity, and availability. Beyond the base score there are temporal and environmental adjustments that account for available exploits and your own context. Broadly, scores fall into bands from low to critical. Organisations use CVSS to prioritise vulnerabilities and decide how urgently to patch. The number is an aid, not an absolute truth: real urgency also depends on exposure and business context.

D

Data Export

Data export is the process of moving data out of Google Workspace or Google Cloud into a downloadable file or an external storage location, for example for migration, backup, archiving or analysis. Workspace administrators can start an organization-wide export from the Admin console that gathers content from services such as Gmail, Drive, Calendar and Contacts and prepares it for retrieval. Individual users can also download their own data with Google Takeout. An export supports data portability and helps satisfy the right to data transfer under the GDPR. Because an export can contain sensitive information, it is important to store the downloaded files securely, encrypt them where needed and restrict who can access them.

Data Loss Prevention

Data Loss Prevention, abbreviated DLP, is a set of policies and techniques that stops sensitive data from being shared, leaked or sent outside the organization without authorization. The system scans content for recognizable patterns such as credit card numbers, national identifiers, passport details or confidential keywords, and then performs a configured action: warn, block, quarantine or log the event. In Google Workspace, administrators can apply DLP rules to Gmail, Drive, Chat and Chrome, while Google Cloud offers a dedicated service for discovering and masking sensitive data. DLP is an important tool for meeting regulations such as the GDPR and HIPAA and for reducing the chance of data breaches, without depending on employees to police it themselves.

Data Region

A Data Region is a Google Workspace feature that lets an administrator define the geographic region where the organization's covered data is stored, usually choosing between the United States, Europe or no preference. It is aimed primarily at organizations with data-residency and compliance requirements, such as data protection within the EU. The policy can apply to the whole organization or be set per organizational unit. Importantly, it covers specific data types and depends on the Workspace edition, so users without a supported license are not covered. Choosing a region does not improve performance; users outside the chosen region may actually experience slightly more latency.

DDoS

DDoS stands for Distributed Denial of Service: an attack that renders a website, application, or network unreachable by flooding it with traffic or requests from many different sources at once. Because the traffic originates from numerous compromised devices in a botnet, it is hard to distinguish from legitimate visitors and cannot be stopped by simply blocking a single IP address. The attack exhausts server capacity, bandwidth, or connections so that real users can no longer get through. Defense relies on absorbing and filtering traffic at large scale, often through a globally distributed network. In Google Cloud, Cloud Armor together with global load balancing helps absorb such attacks before they reach the underlying services.

Delegation

Delegation is the act of granting access to another user's mailbox or calendar, so that a designated person can read, reply to and send messages or manage appointments on the owner's behalf. This is useful when, for example, an executive assistant runs a manager's inbox and schedule, or when a shared role-based mailbox is handled by several colleagues. In Gmail and Google Calendar the user or the administrator sets this up, with varying permission levels such as read-only or full management. With delegation the owner remains visible as the sender, while it is clear that an authorized person is acting on their behalf. It is wise to review delegations periodically and revoke them once the access is no longer needed, to prevent unwanted visibility.

Device Policy

A device policy is the collection of rules an administrator imposes on the mobile devices, laptops and other endpoints that have access to company data. Through this policy you can enforce requirements such as a screen lock with PIN or biometrics, a minimum operating system version, storage encryption, and the ability to remotely wipe a lost or stolen device. In Google Workspace you manage this with endpoint management in the Admin console, where you can distinguish between basic and advanced management and target policies at specific organizational units. A solid device policy is essential for protecting corporate data when employees work from a wide range of devices, including personal ones, and it supports a zero-trust security model.

DHCP

DHCP (Dynamic Host Configuration Protocol) is the protocol that automatically gives devices on a network the right settings. As soon as a laptop, phone, or printer connects, it asks the DHCP server for an IP address, and the server assigns one from a free range, along with extra details such as the gateway address and the DNS servers. The assigned address is valid for a set period, the so-called lease, after which it is renewed or released. Without DHCP an administrator would have to configure every device by hand, which is why it is a standard core service in almost every home and business network.

Directory

The Directory is the central list of users and groups in an organization's Google Workspace: the address book that holds all employees, their email addresses and relevant profile details, and shared groups. Thanks to the directory, people can find and auto-complete each other in Gmail, Calendar and Contacts, and it forms the foundation to which administrators attach licenses, policies and access rights. Administrators maintain the directory from the Admin Console and control which details are visible through settings such as contact sharing. The directory is often synchronized with an external identity source, for example via Google Cloud Directory Sync from an existing LDAP or Active Directory environment.

Directory Sync

Directory synchronization is the automatic process of keeping user accounts, groups and organizational structure aligned between an existing directory service, such as Microsoft Active Directory or an LDAP server, and Google Workspace. This avoids managing accounts twice by hand: when someone is created, changed or disabled in the source system, Google adopts that change. For this Google offers tools such as Google Cloud Directory Sync (GCDS), which performs a one-way sync that aligns the Workspace directory with the source information without modifying the source itself. Reliable synchronization yields consistent identities, eases single sign-on and reduces security risk, because departed employees lose their access promptly and automatically.

Discovery

Discovery, in compliance and legal contexts often called eDiscovery, is the practice of locating, preserving and searching electronic data for legal proceedings, audits or internal investigations. The aim is to find relevant emails, documents and chat messages, protect them against change or deletion, and export them in a usable form as evidence. In Google Workspace, Google Vault provides this functionality: administrators and legal teams can set retention rules and legal holds, run targeted searches across Gmail, Drive, Chat and Meet, and secure the data they find. In this way eDiscovery helps organizations meet retention obligations and disclosure requests while preserving the integrity of the material.

Distillatie

Distillation, in full knowledge distillation, is a technique where a large, capable AI model (the teacher) is used to train a smaller model (the student), so that the smaller model inherits much of the knowledge and behaviour while running faster and more cheaply. The student learns not only from the correct answers but also from the teacher's nuanced predictions, which lets it retain more than it would from ordinary training on individual examples. The result is a more compact model suited for deployment on devices with limited compute or for use cases where low latency and cost matter. Many lightweight models, including variants in Google's Gemma family, benefit from techniques like this.

DKIM

DKIM (DomainKeys Identified Mail) is an email authentication method that adds a cryptographic signature to outgoing messages. The sending server signs relevant parts of the message with a private key, while the matching public key is published in a DNS record. Recipients use that public key to verify that the message genuinely originates from your domain and has not been altered in transit. In this way DKIM helps prevent forgery and tampering. In Google Workspace you generate and enable DKIM in the Admin Console, then add the supplied key as a DNS record at your domain provider. Together with SPF and DMARC, DKIM underpins reliable email delivery and a strong sender reputation.

DMARC

DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email policy published as a DNS record that builds on SPF and DKIM. It tells receiving mail servers what to do with messages that fail the SPF and/or DKIM checks: take no action (none), quarantine them, or reject them. DMARC also provides reporting, sending you feedback by email about who is sending messages on your domain's behalf and how authentication performs. This protects your domain against spoofing and phishing while giving you visibility into abuse. In Google Workspace you configure DMARC once SPF and DKIM work correctly, gradually tightening the policy from none to reject as the reports confirm that legitimate mail still gets through.

DMARC-policy

The DMARC policy is the instruction in your DMARC record that tells receiving mail servers what to do with messages from your domain that fail the SPF and DKIM checks. There are three values: none lets such mail through and is used to gather reports first, quarantine moves suspicious mail to the spam folder, and reject refuses the mail entirely. The recommended approach is phased: start with none to gain insight from the reports, confirm that legitimate senders are configured correctly, then tighten to quarantine and ultimately reject. Only at quarantine or reject does DMARC offer real protection against spoofing and phishing using your domain. In Google Workspace you publish this record through your DNS management.

DNS

DNS, the Domain Name System, is the address book of the internet. It translates human-readable domain names such as cloud-captains.com into the numeric IP addresses that servers actually use to find one another, so people never have to memorise strings of digits. In Google Workspace, DNS is central to setting up your domain: DNS records link your domain to Google. An MX record routes email to Gmail servers, a TXT record can verify ownership or prove the authenticity of your mail through SPF, DKIM and DMARC, and a CNAME record can point to a service like Google Sites. Changes to DNS take time to spread across the internet, a process known as propagation.

Docker

Docker is a popular platform for packaging applications into containers: lightweight, isolated units that bundle the code together with all the libraries and settings it needs to run. Because a container carries its exact environment with it, an application behaves the same on a developer laptop, on a test server, and in production, which largely eliminates the classic it-works-on-my-machine problem. A container shares the host operating system kernel, making it far lighter and faster to start than a full virtual machine. In practice you build an image from a Dockerfile and share it through a registry. On Google Cloud, containers underpin services such as Cloud Run and Google Kubernetes Engine, where you deploy a Docker image directly.

Docker Compose

Docker Compose is a tool that lets you define, start and stop several cooperating containers at once from a single configuration file. In that file you describe, per service, which image is used, which ports and volumes are needed, which environment variables apply and how the containers connect to each other. A single command then brings the whole set up together, which is ideal for a local development environment where, for example, a web application, a database and a cache need to run side by side. It keeps the setup reproducible and easy to share within a team. Compose targets a single machine; running containers spread across multiple servers is usually handled by Kubernetes.

Dockerfile

A Dockerfile is a text file containing step-by-step instructions that build a container image automatically and reproducibly. Each line describes a step, such as choosing a base image, copying application code, installing dependencies or setting the startup command. Because the entire build is captured as code, everyone using the same file gets an identical result, removing the need for manual tinkering. Many instructions create separate layers, so their order affects how well the cache is reused and how fast a rebuild runs. A Dockerfile is often the first step in an automated build-and-deploy chain, for example toward Cloud Run or Google Kubernetes Engine.

DOM-based XSS

DOM-based XSS is a variant of Cross-Site Scripting that arises entirely in the browser, without the server ever reflecting the payload. The flaw lives in client-side JavaScript that writes untrusted input, for example from the URL, the fragment after the hash, or localStorage, directly into the Document Object Model through dangerous sinks such as innerHTML, document.write, or eval. Because the malicious code never travels through the server, server-side filtering and logging see nothing, which makes it harder to detect. The defence is on the frontend: use safe APIs such as textContent, avoid building HTML from uncontrolled strings, and apply Trusted Types and a Content Security Policy where possible. It is a common risk in modern single-page apps and dashboards.

Domain Alias

A domain alias is an additional domain name attached to an existing Google Workspace account, allowing users to receive email at multiple domains without creating separate accounts or licences for each one. If your primary domain is company.com and you also register company.net as an alias, then jane@company.com automatically receives mail addressed to jane@company.net as well. It is the same mailbox under a different domain name. A domain alias differs from a secondary domain, where users get a distinct identity per domain instead. Aliases are useful during rebranding, for protecting brand names, or for serving several country extensions from a single organisation.

Domain Verification

Domain verification is the step that proves to Google that you genuinely own the domain you want to use in Google Workspace or another Google service. It prevents anyone from claiming a domain that is not theirs. Verification usually happens by adding a unique TXT record to your domain's DNS settings, or by placing a special HTML file on your website. Google then checks that the record or file is present, and only after that can you activate users, email and other services on the domain. Verification therefore acts as a gatekeeper: without this proof of ownership, your domain remains unusable within Workspace.

Domeincontroller

A domain controller is a Windows server that manages logon and permissions for an entire network through Active Directory. It holds the central user database, verifies passwords at sign-in and, through group policy and access rights, determines what users and computers in the domain are allowed to do. Because authentication is centralized, users only need to manage a single account to access multiple systems. For reliability, organizations often run several domain controllers that replicate their data to one another, so that sign-in keeps working if one fails. When moving to the cloud, many companies connect their on-premises Active Directory to Google Cloud or synchronize identities toward Google Workspace, so the same users can also use cloud services.

Drive

Google Drive is Google's cloud storage and collaboration service, where you store, share and co-edit files from any device with an internet connection. It holds documents, spreadsheets, presentations, images and virtually any other file type, all kept safely in the cloud and synced automatically. Within Google Workspace, Drive comes in two forms: My Drive for an individual user's personal files, and Shared Drives that belong to a team rather than a person, so files persist even when someone leaves the organisation. Sharing permissions are fine-grained, from view-only to full editing, and administrators can use policies to control how data may be shared inside or outside the organisation.

Drive for desktop

Drive for desktop is Google's official desktop app that mounts your Google Drive as a drive in File Explorer on Windows or Finder on macOS. You then work with your cloud files as if they were stored locally, without everything permanently taking up space on your hard drive; files are streamed and downloaded on demand. You can also make folders available offline for when you are on the move, and changes sync back to the cloud automatically. In addition, the app can back up local folders such as Documents or Desktop to Drive. It is meant to let you work seamlessly between local programs and Google Drive, combining storage and collaboration.

Drive Label

A Drive Label is a metadata label used to classify, organize and apply policies to files in Google Drive and messages in Gmail. A label can be a simple marker such as Confidential, but it can also contain structured fields like dropdown lists, dates, numbers or people. Labels are applied manually by users, automatically through DLP rules or set as a default label on new files, and they can also be managed through an API. They are valuable for information governance and data loss prevention: a file labeled confidential can, for example, be blocked from external sharing by a rule. Labels also enable targeted search by classification. The feature requires a supported Workspace edition.

Dynamic Group

A dynamic group in Google Workspace is a group whose membership is not maintained by hand but determined automatically through a query on user attributes. You define a rule, for example all users in the Sales department or a particular location, and Google then adds the matching people itself and removes them as soon as their details change. This keeps distribution lists, access rights and policies continuously up to date without an administrator having to intervene on every staffing change. Dynamic groups save time and reduce the chance of error, especially in large organisations where people frequently switch roles or departments. They do require the underlying user data in the directory to be filled in cleanly and consistently.

E

Edge AI

Edge AI means running AI processing close to where the data is created, on the device itself or a nearby local unit, instead of in a central cloud. The so-called edge is the boundary of the network: a phone, camera, sensor, or machine. By doing the computation there you reduce latency, can often keep working without an internet connection, and keep sensitive data local, which helps privacy. A common approach is to train a model in the cloud and then deploy it to the edge for inference, sometimes supported by an NPU inside the device.

Embedding

An embedding is a numerical vector, that is a long sequence of numbers, that captures the meaning of a piece of text, an image or other data in a form a computer can compare. Texts with related meaning receive vectors that lie close together, even when they use different words, so you can search by meaning rather than by exact keywords. This semantic search is the foundation of modern AI applications such as recommendations, classification and, above all, Retrieval-Augmented Generation, where embeddings are used to find the most relevant documents for a question. The vectors are computed by an embedding model and stored in a vector database. In Google Cloud you generate embeddings through the Vertex AI embedding models, which you can then search for use cases such as internal knowledge bases and smart search features.

Encryption

Encryption is the scrambling of data, turning readable information into unreadable ciphertext using a mathematical algorithm and a key, so that only someone holding the correct key can decipher the original content again. It protects data against unauthorised access, both in transit across the network and at rest on a server or disk. Google Workspace encrypts data by default in transit and in storage. For organisations with stricter requirements, Google offers client-side encryption, where content is encrypted on the user's own device with keys the customer controls, so that not even Google can read the data. Encryption is therefore a cornerstone of confidentiality and of many privacy and compliance obligations.

Endpoint (API)

An API endpoint is a specific address where an application sends requests to perform a particular action or to fetch data. In a REST API such an endpoint consists of a URL combined with an HTTP method such as GET, POST, PUT or DELETE, where each path usually represents a resource or operation. The endpoint is therefore the entry point behind which the service's logic stays hidden: the client only needs to know the address, the allowed methods and the expected format. In the context of Google Cloud, almost every service and AI model exposes its own endpoints, and with API Gateway or Cloud Endpoints you can manage, secure and apply quotas to them in one central place.

Endpoint Management

Endpoint management is the central administration and protection of every device employees use to reach company data: laptops, phones, tablets and desktops. In Google Workspace this is handled through Endpoint Management, which lets administrators enforce policies such as a mandatory screen lock, strong passwords or device encryption. If a device is lost or stolen, you can lock it remotely or wipe the company data on it, keeping sensitive information out of the wrong hands. Workspace offers a basic tier that delivers fundamental protection with little setup, and an advanced tier with deeper control over apps and configuration. Endpoint management thus ensures that the growing number of devices in an organisation does not become a weak link in security.

Endpoint Verification

Endpoint Verification is a Google feature that gives administrators visibility into the devices accessing company data. Through a Chrome extension, optionally paired with a native helper app, it collects device attributes such as operating system, encryption status and disk encryption, then syncs them with Google to build a device inventory in the Admin console. These attributes feed Context-Aware Access, the framework that conditions access to Google Workspace and Google Cloud on a device's security posture, so that only sufficiently protected machines reach sensitive resources. As such, it is a foundational building block for a zero-trust approach across Google Workspace and Google Cloud.

Event log

The event log is the central logging facility in Windows where the system records events: informational messages, warnings, errors and security events such as logon attempts. The logs are split into categories like System, Application and Security, and each entry carries a timestamp, a source, an event ID and details. Administrators consult these logs through Event Viewer to diagnose problems, investigate performance issues and detect suspicious activity. In a larger managed network, event logs are often forwarded to a central collector or a SIEM system, so that events from many machines can be analyzed together and retained for auditing and security purposes.

Exchange Server

Exchange Server is Microsoft's email and calendar server that an organization installs and manages itself, typically on its own Windows server. It handles mailboxes, shared calendars, contacts and tasks for Outlook users, making it the classic on-premises alternative to cloud mail such as Gmail in Google Workspace. Running it yourself means full control, but also responsibility for updates, backups, storage and security. Microsoft offers a hosted cloud version called Exchange Online. When migrating to Google Workspace, existing Exchange mailboxes are usually moved with Google's migration tools, after which the on-premises Exchange Server can be phased out and the burden of maintaining that hardware disappears.

Exploit

An exploit is a piece of code, a script or a technique that abuses a specific security flaw to achieve something unintended, such as running arbitrary code, gaining elevated privileges or crashing a system. An exploit therefore always presupposes an underlying vulnerability. Particularly dangerous are zero-day exploits, which abuse a flaw for which no patch yet exists. Researchers also use exploits legitimately to test defenses and demonstrate that a vulnerability is genuinely exploitable. The main defense is closing vulnerabilities quickly through patches, alongside layered security that limits the impact of any single weakness.

External Sharing

External sharing refers to sharing files, folders or documents with people outside your own organization, that is, with users who do not have an account in your company domain. In Google Workspace, administrators set this policy from the Admin console: external sharing can be fully allowed, restricted to specific trusted domains, or disabled entirely. For each Drive item you can then grant view, comment or edit access and optionally set links to expire. Well-configured external sharing enables collaboration with clients and partners without losing control over sensitive data, making it a key element of data loss prevention and information security.

F

Failover

Failover is the automatic switch to a backup system when the primary system fails, so that a service stays available without users being disrupted. The backup can be a passive standby that activates only on failure, or an actively running replica that takes over traffic immediately. Effective failover relies on continuous health monitoring and often on data replication, so the standby holds current data and can step in without loss. It is a cornerstone of high availability and is reinforced by spreading systems across multiple zones or regions. In Google Cloud, services such as Cloud SQL in a high-availability configuration and regional load balancers provide automatic failover when a zone goes down.

Few-shot prompting

Few-shot prompting is a prompting technique where you include a handful of examples of the desired input and corresponding output directly in the prompt, so that the model recognises the pattern and applies it to a new request. Unlike zero-shot prompting, where you give only an instruction without examples, few-shot helps the model maintain the right tone, structure or classification without needing to be retrained. It is a fast and inexpensive way to steer the quality and consistency of answers. The technique works with virtually all modern language models, including Gemini in Google Cloud, and is especially useful for tasks with a fixed format such as labelling, extraction or rewriting text.

File Stream

File streaming lets you work directly with cloud files without first downloading them in full to your computer. In Google Workspace this technique lives in Google Drive for desktop, where the Stream files mode keeps files in the cloud and only fetches them the moment you open one. As a result all your Drive files appear as an ordinary drive in File Explorer or Finder while taking up almost no local storage. The original standalone app was called Google Drive File Stream and has been folded into Google Drive for desktop, which also offers a mirror mode. Streaming is especially useful for large shared drives and devices with limited disk space.

Fine-tuning

Fine-tuning is the practice of further training an existing, pre-trained AI model on your own, often smaller dataset so that it better fits a specific task, domain or writing style. Instead of building a model from scratch, which takes enormous amounts of data and compute, you build on the general knowledge of a base model and steer it with examples of the desired behaviour. This lets you, for example, instil your organisation's tone of voice or teach the model to handle domain jargon. Fine-tuning differs from Retrieval-Augmented Generation: with fine-tuning you change the model itself, whereas with RAG you supply knowledge as context without altering the model. For changing or factual information RAG is often more convenient; fine-tuning pays off mainly for consistent behaviour and style. In Google Cloud, Vertex AI offers ways to tune Gemini models.

Firewall

A firewall is a security layer that inspects network traffic and, based on configured rules, decides what is allowed through and what is blocked. The rules examine things like source and destination address, port, and protocol, so you keep unwanted or suspicious connections out. A firewall can be a physical appliance, software on a computer, or a cloud service. In Google Cloud you handle this with firewall rules that protect the traffic to and from your virtual machines. Modern, advanced firewalls look beyond ports alone and also recognize applications and known attack patterns.

Forwarding

Forwarding refers to having incoming email sent on automatically to another address. In Gmail a user can set this up themselves, for example to route messages from an old address to a new one, or to send everything to a colleague during an absence. You can choose whether a copy stays in the original inbox or the message is archived or deleted after forwarding, and filters let you forward only specific mail. At the organisation level, an administrator may instead restrict or block forwarding rules, because uncontrolled forwarding to external addresses can leak sensitive company data. Forwarding is therefore convenient for users, but from a security standpoint it calls for clear policy.

FTP

FTP stands for File Transfer Protocol, an older protocol for sending files between computers over a network, for example to upload files to a web server. It was widely used for a long time, but has a major drawback: in its standard form, FTP transmits data, including usernames and passwords, without encryption, so it can be intercepted in transit. For that reason FTP has largely been replaced by safer alternatives such as SFTP and FTPS, which encrypt the connection, and by HTTPS-based transfers. In a modern cloud environment, exchanging files usually happens through secure services and storage such as Google Drive or cloud object storage, rather than classic FTP. Anyone still using FTP would do well to switch to an encrypted variant.

Function calling

Function calling is the ability of an AI model to invoke a predefined function or tool on its own, with structured arguments, based on a user request. Instead of only generating text, the model returns which function it wants to run and with which parameters, after which your application actually executes that function and feeds the result back. This lets a model perform real actions, such as checking a calendar, querying a database or sending an email. The Gemini API in Google Cloud supports function calling, which forms the foundation for agents and assistants that do not just talk but also carry out tasks in systems such as Google Workspace.

G

Gateway

A gateway is the access point through which network traffic leaves a network toward another network or the internet. In a home or office network, the default gateway usually points to the router that forwards local traffic outward and routes replies back to the correct device. A gateway can also connect different types of networks or protocols, acting as a translator between them. In the cloud the term reappears in services such as a NAT gateway or API gateway, which manage the traffic between your internal resources and the outside world in a controlled way.

Gemini

Gemini is Google's family of generative AI models and at the same time the name of the accompanying AI assistant. The models are multimodal: they can both understand and generate text, images, audio, video, and programming code. Gemini comes in different sizes for varying needs, from lightweight models for fast tasks to more powerful models for complex reasoning. You will find Gemini as a standalone chat assistant, integrated into Google Workspace and Android, and as an API in Google Cloud (Vertex AI) that lets developers embed the models in their own applications. Gemini succeeded Google's earlier Bard assistant and forms the core of Google's AI offering for consumers, businesses, and developers.

Gemini Advanced

Gemini Advanced was the name for the paid subscription that unlocked Google's most capable Gemini models, with extra features and a larger context window than the free version. It let you process longer documents and conversations at once and gave access to capabilities such as deep research. Since Google I/O 2025 this offering has been renamed: the subscription is now called Google AI Pro (with Google AI Ultra positioned above it), but the idea is the same, namely a paid tier on top of free Gemini. For Workspace customers it means access to the most capable models and higher usage limits than standard access provides.

Gemini Flash

Gemini Flash is the fast, cost-efficient variant in Google's Gemini family, optimised for low latency and a favourable price per request. That makes it well suited to large-scale tasks where speed and throughput matter more than maximum reasoning power, such as classification, summarisation, chat assistants and processing large volumes of text. Flash still delivers strong quality, but positions itself as the workhorse between the small on-device Nano variant and the more powerful Pro. In the context of Google Cloud and the Gemini API, you often choose Flash when you need to handle many requests per minute at manageable cost, switching to a heavier model only for the most demanding tasks.

Gemini for Workspace

Gemini for Workspace is the integration of Google's Gemini AI into the Google Workspace apps such as Gmail, Docs, Sheets, Slides, and Meet. It helps employees with everyday tasks: writing and rewriting text in Docs and Gmail, summarizing long emails or files, analyzing formulas and data in Sheets, generating images for Slides, and automatically taking notes during meetings in Meet. The AI operates within the existing security and privacy boundaries of Workspace, so business data is not used to train the general models. There is also a separate Gemini chat side panel that lets users query context from their own files. It is designed to boost productivity without requiring employees to leave their familiar working environment.

Gemini Gem

A Gem is a customized version of Gemini that you set up for a specific task or role. You give the Gem standing instructions, such as the tone it should use, the steps it should follow, or the knowledge it should draw on, so you don't have to retype the same context with every request. For example, you might build a Gem that always acts as an editor reviewing your writing, or as a trip planner. Within Google Workspace, Gems are useful for standardizing recurring work and getting consistent results; you can use them personally and, in the paid tiers, share them with colleagues across your organization.

Gemini Nano

Gemini Nano is the smallest variant in Google's Gemini family, designed to run directly on a device rather than in the cloud, for instance on a smartphone or inside the browser. Because the model runs locally, it can handle tasks with low latency, even with no or only a limited internet connection, while sensitive data stays on the device itself. That makes Nano suited to light, privacy-sensitive tasks such as summarising, smart reply suggestions and simple text edits that you would rather not send to a server. In the context of Google Workspace and the wider Google ecosystem, Gemini Nano powers on-device AI features, with heavier or more complex requests still being routed to the larger cloud models Flash or Pro.

Gemini Pro

Gemini Pro is the powerful variant in Google's Gemini family, intended for complex tasks that demand more reasoning power than the lighter models. It excels at work such as in-depth analysis, intricate programming, structured reasoning over long contexts and creative or multi-step problem solving where accuracy matters more than cost or speed. Within the Gemini line, Pro sits at the top of the common three-tier split, above the fast Flash and the small on-device Nano. In the context of Google Cloud and the Gemini API, you turn to Pro for the most demanding requests and for applications where the quality of the result is decisive, while for simpler work at scale you often fall back to Flash.

GGUF

GGUF is a file format for storing and distributing local language models, in particular quantised versions of them. The format bundles the model's weights together with metadata, such as information about the architecture and the tokenizer, into a single file, so a model can be loaded and used in one go. GGUF was developed in the context of llama.cpp and is the successor to the older GGML format, with the aim of being more future-proof and flexible. It is used by llama.cpp and related tools such as Ollama and LM Studio. Anyone downloading local models will frequently encounter GGUF files in various quantisation levels that trade off memory against quality.

Git

Git is a distributed version control system that tracks every change to code and files and makes collaboration between developers possible. Each developer has a full copy of the project history on their own machine, can work independently in branches, and merge those changes later. Because Git preserves every version, you can always look back at who changed what and when, and revert to an earlier state if needed, which makes mistakes easy to undo. Originally created by Linus Torvalds, Git is the de facto standard for modern software development and underpins platforms such as GitHub and GitLab. It fits seamlessly with CI/CD, where a new commit can automatically trigger tests and deployment.

GKE

GKE stands for Google Kubernetes Engine, the managed Kubernetes service of Google Cloud for deploying and operating containerized applications at scale. Kubernetes is the open-source system for orchestrating containers, and GKE takes much of the heavy lifting off your hands, such as provisioning the cluster, upgrading the control plane and, in Autopilot mode, also managing the underlying nodes. It automatically handles things like load balancing, self-healing of failed containers and scaling workloads up and down based on demand. GKE is aimed at more complex applications made up of many cooperating containers that require high availability and fine-grained control over how they are rolled out.

Gmail Delegate

A Gmail delegate is a user who is granted access to someone else's mailbox on their behalf. The account owner can add a delegate in Gmail, after which that person can read, reply to, send and clean up mail from their own window, without ever knowing the other person's password. Sent messages clearly indicate they were sent on behalf of the owner. Delegation is ideal for an executive assistant or for shared inboxes such as info@ or support@, and is safer than sharing credentials because access can be managed and revoked per delegate. In Google Workspace, administrators can enable or disable delegation domain-wide.

Gmail Routing

Gmail routing covers the rules a Google Workspace administrator sets to determine how inbound and outbound email is handled before it reaches the end user or leaves the organisation. With routing you can redirect messages, keep a copy, apply an extra spam or content filter, or pass mail through an external gateway or security solution. Common uses include splitting mail between Gmail and another mail system during a migration, enforcing archiving for compliance, or automatically appending a standard disclaimer to outgoing messages. Routing acts on conditions such as sender, recipient or keywords, so policy can be highly targeted. It is a powerful but sensitive part of administration, since faulty rules can unintentionally block or misdirect mail.

Google AI Studio

Google AI Studio is a free web environment where you can build and experiment directly with Gemini models. You test prompts, set model parameters such as temperature and the maximum number of tokens, and immediately see how the model responds before putting anything into a real application. From AI Studio you also generate an API key that lets you call the same models from your own code or application through the Gemini API. It is therefore aimed mainly at developers and technical users who want to prototype quickly. Note that it is distinct from the consumer Gemini app and from the Workspace features; AI Studio focuses on building and testing.

Google Chat

Google Chat is the communication platform within Google Workspace for direct messaging and team collaboration. Beyond one-to-one conversations, you work in spaces, shared places where a team gathers messages, files and tasks around a project or topic. Chat is tightly woven into the rest of Workspace: you can easily share files from Drive, co-open a document, or start a Google Meet call straight from a conversation. Messages are searchable and retained according to the organisation's retention policy. Administrators can decide whether staff may also chat with external parties. Through apps and bots you can integrate notifications and automated workflows into Chat as well, making it more than just a messaging app.

Google Cloud Directory Sync (GCDS)

Google Cloud Directory Sync (GCDS) is a free Google tool that synchronizes users, groups, shared contacts and organizational units from an existing LDAP directory or Microsoft Active Directory into Google Workspace or Cloud Identity. The synchronization is one-way: the on-premises directory remains the source of truth and GCDS adapts Workspace to match it, so you avoid managing users twice. You define rules and filters for which objects are included, and you can run a simulation first to preview the changes before applying them for real. GCDS typically runs as a scheduled job on a server inside the corporate network and is a common step when moving from a traditional Windows environment to Workspace.

Google Forms

Google Forms is the tool within Google Workspace for creating questionnaires, surveys, registration forms and quizzes. You build a form using various question types, such as multiple choice, short text, scale questions and file uploads, and you can use conditional logic to route respondents to the right follow-up questions. Responses are collected and summarized automatically in charts, and can be exported to Google Sheets with one click for further analysis. In quiz mode you can set correct answers and point values so scores are calculated automatically. Forms are easy to share via a link or embed on a website, and within Workspace you can restrict access to people in your own organization. It is a low-threshold way to gather structured information.

Google Keep

Google Keep is an app for quick notes, to-do lists, voice memos and reminders that syncs across all your devices and within Google Workspace. Notes appear as cards you can color, label, pin or share with colleagues for real-time collaboration. You can add images whose text Keep can recognize, and create handwritten notes on a touchscreen. Location- or time-based reminders help you pick things up at the right moment. Keep integrates with other Workspace apps: you can view a note from the side panel in Gmail, Calendar or Docs, and pull the contents of a Keep note straight into a Google Doc. It is meant for loose, short-lived notes rather than extensive documents.

Google Meet

Google Meet is Google's video conferencing and calling platform, integrated into Google Workspace. You start or schedule a call straight from Google Calendar, Gmail or Chat, and participants join through a browser or the mobile app without installing extra software. During a meeting you can share your screen, use the chat, open a digital whiteboard and, depending on your licence, record the session or have it captioned automatically. Larger organisations gain features such as breakout rooms, attendance reports and livestreams to big audiences. Administrators use policy to decide who may record meetings or who from outside the organisation may join. Meet thus enables reliable online collaboration that connects smoothly with the other Workspace services.

Google Sites

Google Sites is the tool within Google Workspace for building websites without any coding knowledge, such as internal intranets, project pages, team portals or simple public sites. You work in a visual editor where you drag text, images, videos and buttons onto a page, and you can embed content directly from other Workspace services, like a document from Drive, a calendar, a form or a chart from Sheets. The result adapts automatically to computer, tablet and phone. Because Sites is woven into Workspace, the same sharing settings govern who may view or edit the site, so an intranet can easily be restricted to your own organisation. It is therefore an accessible way to share information centrally and clearly.

Google Tasks

Google Tasks is a simple to-do list integrated into Gmail, Google Calendar and the mobile Workspace apps for managing personal action items. You create tasks, add subtasks and notes, and set a due date; tasks with a date appear automatically in your Calendar so you see them in your schedule. From Gmail you can turn an email directly into a task, handy for not forgetting follow-ups. You can create multiple lists to separate work and personal items, and everything syncs across devices through your Google account. Tasks is deliberately minimal: it focuses on individual task management and does not offer extensive project features such as assigning work to teammates or dependencies.

Google Voice

Google Voice is the cloud telephony service within Google Workspace that gives organizations business phone numbers not tied to a physical device. Users make calls and send texts through the Voice app on their phone or in the browser, receive voicemail that is automatically transcribed, and can forward calls to other numbers or devices. Because it runs in the cloud, the same number stays reachable no matter where you work. Admins assign numbers and manage settings centrally through the Admin console, and Voice integrates with Calendar and Meet. It is meant to make business telephony simpler and more flexible without a traditional phone system.

Google Workspace Migrate

Google Workspace Migrate is a Google tool built for large-scale migrations of email, files, calendar items and sites into Google Workspace, often from environments such as Microsoft Exchange, SharePoint, OneDrive or another Workspace domain. The tool runs on Windows servers inside the customer's network and is designed to handle large volumes of data, with features to estimate up front how much data will transfer, run the migration in phases and track progress. By distributing the work across multiple servers, or nodes, the migration throughput can be scaled up. Workspace Migrate targets complex moves for organizations with many users and is therefore heavier than the simpler migration options available directly in the Admin console.

GPO

GPO stands for Group Policy Object: a collection of settings in Windows networks that lets administrators apply policy centrally to users and computers within Active Directory. With a GPO you define things like password rules, security settings, desktop configurations or software installations and link them to domains, sites or organizational units. Devices and users receive the policy automatically at sign-in or periodically, removing the need for manual work on each machine. GPOs have long been the standard way to manage Windows environments consistently and securely. In a Google Workspace context, Context-Aware Access and management through the Admin console fill a comparable role for user and device policy, while for ChromeOS devices cloud-based policy takes the place of classic GPOs.

Greylisting

Greylisting is an antispam technique in which a mail server temporarily rejects email from an unknown sender on the first attempt, with a message indicating it should be retried later. Properly configured, legitimate mail servers follow the SMTP standard and automatically resubmit the message after a short while, at which point it is accepted. Many spam systems send in bulk only once and never retry, so a large share of unwanted mail simply drops off. The drawback is a slight delay on the first message from a new contact. Google Workspace does not use classic greylisting but instead relies on advanced reputation- and machine-learning-based filters in Gmail to block spam.

Grounding

Grounding is the practice of anchoring AI answers in reliable external sources such as search results, your own documents or a knowledge base, so that the output is factual and verifiable. Instead of relying solely on what the model learned during training, a grounded system retrieves current or company-specific information and bases its answer on it, often including source citations. This reduces hallucinations and makes answers auditable. In Google Cloud you can ground Gemini on Google Search or on your own data through Vertex AI, which makes it suitable for business use cases where correctness and traceability matter.

Group

A Group, or Google Group, is a shared email address that doubles as both a mailing list and a collaboration space within Google Workspace. Send a message to the group address and it instantly reaches every member, so you never have to list recipients one by one. Administrators create groups in the Admin console or through Google Groups, and they also use them to grant access to shared Drives, calendars and Workspace settings in a single step. That way permissions are maintained in one place rather than per individual. Groups support roles such as owner, manager and member, and can be open or restricted. From a security standpoint it matters who is allowed to join and whether external senders may post.

Group Alias

A Group Alias is an additional email address that points to an existing Google Group. Mail sent to the alias automatically lands in the same group, and therefore reaches the same members, as the primary address. Aliases are useful when a team wants to be reachable under several names, such as info@ and contact@, or when you need to keep an old address working after a rename so that no email is lost. An administrator adds aliases in the Admin console, and you can attach several of them to one group. The alias has no mailbox or membership list of its own: it is simply a forwarding label onto the underlying group, which keeps administration straightforward.

Groups for Business

Groups for Business is Google's business-grade group functionality, built on Google Groups and integrated into Google Workspace. A group has a shared email address, such as team@ or sales@, so that a message sent there reaches every member at once. Beyond acting as a mailing list, a group can serve as a shared inbox, a discussion forum, or a convenient way to grant access to Drive files, calendars and other resources in a single step. Administrators decide in the Admin console who may create groups and who may join, and can control whether messages from outside the organization are allowed. This streamlines the management of communication and access rights for entire teams.

Guardrails

Guardrails are built-in boundaries, rules and controls that determine what an AI system may and may not do or say, keeping it safe, predictable and within policy. They can filter inputs, check outputs and constrain the actions of a model or agent, for example by ruling out certain topics, protecting sensitive data or blocking risky operations. Guardrails matter especially in agentic applications, where a model performs real actions and mistakes have real consequences. In Google Cloud you combine things like safety settings, access permissions and validation logic around Gemini, so that generative AI can be deployed responsibly within an organisation.

Guest User

A Guest User is someone from outside your organization who is granted limited access to specific resources without holding a full account in your Workspace domain. In practice these are often external partners, clients or freelancers with whom you share a particular file, a shared Drive or a joint document. The guest signs in with their own Google account or another email address and only sees what has been explicitly shared; they fall outside your internal policies, licensing and most admin controls. From a security perspective it is wise to review guest access regularly, set expiry dates on sharing links and restrict which domains may collaborate externally, so that data does not stay exposed unintentionally.

H

Hallucinatie

A hallucination is the phenomenon where an AI model confidently presents incorrect, invented or non-existent information as fact. Because a language model predicts the most likely continuation of text and does not truly know what is true, it can produce fluent, believable answers that are factually wrong, such as made-up sources, quotes, figures or names. Hallucinations are one of the main risks of using generative AI, precisely because the errors look just as self-assured as correct answers. Techniques such as Retrieval-Augmented Generation, where the model grounds its answer in retrieved sources, reduce the problem but do not eliminate it entirely. The practical rule remains: always verify important outputs against a reliable source before acting on them.

Hardware Key

A hardware security key is a physical device that serves as a strong second factor when signing in (MFA). It usually looks like a small USB, NFC or Bluetooth key and, during login, confirms that the user genuinely possesses the device. Because the key relies on standards such as FIDO2 and WebAuthn, it is resistant to phishing: it only releases a valid signal to the genuine website, never to a spoofed copy. In Google Workspace, administrators can require these keys for sensitive accounts, and they form the core of Google's Advanced Protection Program. As such, they offer the highest level of account protection against takeover.

Hashing

Hashing is the conversion of arbitrary data into a fixed-length string of characters using a mathematical hash function. The result, the hash, cannot in practice be reversed back to the original input, and the same input always yields the same hash, while a small change in the input produces a completely different hash. This is why hashing is used to store passwords securely without keeping them in readable form, and to verify the integrity of files or messages. For passwords you use slow, purpose-built algorithms such as bcrypt, scrypt, or Argon2, often with an added salt; for integrity checks SHA-256 is common. Hashing differs fundamentally from encryption because it is deliberately irreversible.

Health check

A health check is an automated probe that periodically verifies whether a service is still functioning correctly. It typically works by sending a request to a dedicated endpoint (such as /healthz) at a fixed interval and checking that the response arrives on time and is valid. When an instance stops responding it is marked unhealthy and automatically removed from rotation or replaced, so traffic only reaches working instances. In Google Cloud, health checks are heavily used by load balancers and by managed instance groups in Compute Engine to repair faulty virtual machines in time. A distinction is usually drawn between liveness checks, which determine whether a process is still alive, and readiness checks, which determine whether it is ready to receive traffic.

Helm

Helm is a package manager for Kubernetes that lets you install, upgrade and remove complete applications as reusable charts. A chart bundles all the Kubernetes resources an application needs, along with configurable values, so you can roll out the same application across different environments with a single command and tailor it per environment through parameters. This avoids managing dozens of separate configuration files by hand. Helm also tracks releases, allowing you to roll a change back to a previous version if something goes wrong. Charts can be shared through repositories, much like how software packages are distributed, and work broadly, including on Google Kubernetes Engine.

Honeypot

A honeypot is a deliberately vulnerable-looking system or service that has no real production value and exists solely to lure attackers. Because no legitimate user has any reason to touch it, almost any interaction with a honeypot is suspect by definition, which makes it a valuable detection and research tool. Security teams use it to observe attack techniques, tools, and behavior, to gain early warnings, and to divert attackers away from real systems, all without putting actual data or services at risk. Honeypots range from simple fake services to fully simulated environments. They do require careful isolation, so that a compromised honeypot cannot serve as a stepping stone into the real network. The intelligence gathered helps refine detection rules and defenses.

I

IaC

IaC stands for Infrastructure as Code: describing servers, networks and other infrastructure in machine-readable configuration files instead of clicking them together manually through an interface. Because the desired state is captured as code, you can roll out infrastructure reproducibly, place it under version control, review it and roll it back when things go wrong, just like ordinary source code. This keeps environments consistent and prevents drift caused by manual work. Many IaC tools are declarative: you describe the end result and the tool works out which changes are needed to get there. It lowers the risk of configuration errors and makes audits easier. Well-known examples are Terraform and, specific to Google Cloud, Config Connector and Cloud Deployment Manager.

IAM-rol

In Google Cloud, an IAM role is a collection of permissions that together determine which actions are allowed on which resources. Through Identity and Access Management you assign such a role to a principal, for example a user, a group or a service account, giving it exactly the access the task requires. Google distinguishes basic roles, predefined roles tailored to specific services, and custom roles that you compose yourself. Assigning roles ideally follows the principle of least privilege: grant no more permissions than necessary to limit the risk of misuse and mistakes. A sound role and access structure is a cornerstone of securing a Google Cloud environment.

Idempotentie

Idempotence is the property that performing an operation multiple times produces exactly the same end result as performing it once. The first call may change something, but every repetition after that leaves the state unchanged. This matters for reliable APIs and distributed systems, because requests can fail or arrive twice due to network issues or automatic retries. By making operations idempotent, often with an idempotency key, a client can safely retry without, for example, creating two payments or two identical records. In Google Cloud you encounter this in API design and in infrastructure as code, where applying the same configuration repeatedly should always lead to the same desired end state.

Idle Session

An idle session is a signed-in session in which no user activity occurs for a set period, such as no clicks, keystrokes or requests. Security policy often ties a timeout to this: once the period elapses, the user is automatically signed out or must re-authenticate. This limits the risk that an unattended or stolen device is misused to reach sensitive data. In Google Workspace, administrators can configure session length and re-authentication through the Admin console and Context-Aware Access, for example a shorter validity for higher-risk resources. Shortening the session length increases security but requires users to sign in again more often.

IIS

IIS stands for Internet Information Services, the web server built into Windows Server for hosting websites, web APIs and web applications. IIS handles incoming HTTP and HTTPS requests, manages sites and application pools, and integrates closely with the Windows platform and with .NET applications. Administrators configure it through a graphical management console or with PowerShell, and can set features such as authentication, compression and TLS certificates per site. This makes IIS the Windows-world counterpart to web servers like Apache and Nginx. If you want to bring an IIS-hosted application to Google Cloud, you can keep it running on a Windows VM in Compute Engine, or containerize the application and deploy it on Cloud Run or Google Kubernetes Engine for a more scalable, managed setup.

Image (container)

A container image is an immutable, ready-to-run template that bundles an application together with everything it needs to run: the code, runtime, system libraries and configuration. From a single image you can repeatedly start identical containers, whether on your laptop, in a test environment or in production, which solves the familiar "it works on my machine" problem. Images are built from stacked layers, so shared layers only need to be stored and transferred once. In a Google Cloud setting you typically build images and keep them in Artifact Registry, then deploy them to services such as Cloud Run or Google Kubernetes Engine.

IMAP

IMAP stands for Internet Message Access Protocol, the standard protocol an email client uses to access and synchronize messages on a mail server. Unlike the older POP3, which typically downloads messages and stores them locally, IMAP keeps the mail on the server and keeps state, such as read flags, folders and deletions, consistent across all your devices. Open a message on your phone and you see the same status on your laptop. Within Google Workspace and Gmail you can enable IMAP to connect Gmail to external programs such as Outlook or Apple Mail. Administrators can turn IMAP on or off per organization, and because the traffic should run over TLS, a properly encrypted connection is important for security.

Import Tool

An Import Tool is a utility for moving existing data into Google Workspace, for example from another mail system, a previous provider or local files. Google offers several options for this, such as the Data Migration Service for email, calendars and contacts, and the Google Workspace Migrate platform for larger migrations of data and shared folders. These tools carry over messages, folder structures and metadata so that users lose as little as possible after the switch. A successful import calls for preparation: clean up the source data, map accounts and aliases in advance and run a test on a small pilot group first. During migrations, also mind privacy and access rights so that sensitive data stays protected while it is being transferred.

Incognito Mode

Incognito mode is a private browsing mode in Google Chrome and other browsers in which no browsing history, cookies or form data are kept locally once you close the window. It is especially handy on shared or public computers, or to view a site briefly without existing sign-in sessions. Incognito does not make you anonymous on the internet, however: your employer, school network, internet provider and the websites you visit can still see your activity, and downloaded files and bookmarks persist. In a managed Google Workspace environment, administrators can even disable incognito mode, for example to keep browsing activity traceable or to prevent policies from being bypassed.

Inferentie

Inference is the phase in which an already trained AI model is used to generate an answer or prediction for new input. It contrasts with the training phase, in which the model learns its parameters from large amounts of data; during inference those parameters are fixed and the model simply does the work of applying them. Every time you ask a question to a chat assistant or have a text summarised, inference is taking place. Because inference on large models demands a great deal of compute and memory and often has to happen in real time, its cost and speed are an important consideration when putting AI into production. In Google Cloud you run inference at scale through Vertex AI, which serves models behind a managed endpoint so applications can request predictions from them.

Ingress

Ingress is the part of Kubernetes that governs how traffic from outside the cluster reaches the correct internal services. Instead of exposing every service separately to the outside world, you define routing rules in an Ingress resource based on, for example, hostname and URL path, so that a request automatically lands at the matching service. An Ingress only takes effect together with an Ingress controller, the program that actually enforces the rules. Ingress often also handles HTTPS termination, centralising the management of TLS certificates. In Google Kubernetes Engine, an Ingress typically maps to a Google Cloud load balancer that distributes external traffic to the pods.

IP Allowlist

An IP Allowlist is a list of trusted IP addresses that are explicitly granted access to a service, while all other traffic is denied or scrutinized more strictly. It follows the principle that only what is on the list is admitted, in contrast to a blocklist, which instead blocks known malicious addresses. Within Google Workspace and Google Cloud you use allowlists, for example, to limit SMTP relay or admin access to the IP ranges of your own office or data center, or to shield Cloud resources with firewall rules. It is an effective security measure but requires upkeep: changing or dynamic IP addresses, remote workers and VPNs can lock out legitimate users if the list is not kept current.

J

Jamboard

Jamboard was Google's digital whiteboard, available as an app and as a physical touchscreen, that let teams draw together, add sticky notes and work out ideas visually within Google Workspace. It integrated with Drive and Meet, so a whiteboard session during a video call could be shared and saved. Google has since retired Jamboard: from October 1, 2024 the app went into read-only mode and on December 31, 2024 the service was shut down for good, after which existing Jams were converted to PDFs in Drive. As a replacement, Google points to whiteboard partners such as FigJam, Lucidspark and Miro, which can be connected through the Workspace Marketplace. The term still turns up regularly in older documentation and migration questions.

JSON

JSON stands for JavaScript Object Notation: a lightweight, highly readable text format for representing structured data and exchanging it between systems. Data is expressed as key-value pairs within braces and as lists within square brackets, where values can be text, numbers, booleans, null, objects, or arrays. Although it originates from JavaScript, JSON is language-independent and is supported by nearly every programming language. Thanks to its simplicity and readability, it has become the standard for configuration files and for communication with web APIs, where it has largely replaced XML. In Google Cloud and Google Workspace, virtually all REST APIs deliver and expect their data in JSON format.

JWT

JWT stands for JSON Web Token: a compact, self-contained token that holds data in JSON form and is digitally signed. A JWT consists of three parts, a header, a payload with claims such as user ID and expiry, and a signature, separated by dots and encoded in Base64URL. Thanks to the signature, the recipient can verify that the contents have not been altered without having to consult the server each time. JWTs are widely used for authentication and authorization in APIs and in single sign-on. Note that the payload is only encoded, not encrypted, so secret data does not belong in it, and always choose a short validity period. Google uses signed JWTs in OpenID Connect and for service accounts, among other things.

K

Knowledge Panel

A knowledge panel is an information box that Google shows automatically when you search for a recognizable entity, such as a person, company, place or concept. On desktop it usually appears to the right of the results and on mobile at the top, offering a compact summary of facts, images and relevant links. Its content comes from Google's Knowledge Graph, a large knowledge base that combines information from the open web; panels are generated algorithmically and only appear once enough reliable information about the entity is available. For organizations a knowledge panel is valuable because it presents a credible profile at a glance. The term is sometimes used more broadly for similar information panels within Google services.

Kubernetes

Kubernetes is an open source system that automates the deployment, scaling, and management of containers across a cluster of multiple servers. Instead of starting containers by hand on individual machines, you describe the desired state, for example how many copies of an application should run, and Kubernetes keeps that state in place: it spreads containers across the available servers, restarts failed instances, and scales up or down based on load. Originally developed at Google and often abbreviated as K8s, it has become the standard for container orchestration. Within Google Cloud, Google Kubernetes Engine offers a managed version where Google maintains much of the cluster and the underlying infrastructure for you.

L

Large Language Model

A Large Language Model (LLM) is a neural network with billions of parameters, trained on vast amounts of text, that predicts the most likely next word or piece of text given an input. Through pattern recognition at scale it can summarise, answer questions, translate, write code and hold conversations without those rules being explicitly programmed. Well-known examples include Google's Gemini models, OpenAI's GPT and Anthropic's Claude. In practice LLMs are the engine behind chat assistants and the AI features in Google Workspace, such as drafting and summarising text in Gmail and Docs. It is important to remember that an LLM reasons about language patterns rather than facts, so its output should always be verified before relying on it for important decisions.

Latentie

Latency is the delay between the moment a request is sent and the moment the response arrives, usually measured in milliseconds. Lower latency means a faster, smoother experience; high latency feels sluggish or choppy, for example during video calls, online gaming, or loading a web page. The delay comes from factors such as the physical distance signals travel, the processing time on servers, and the route the network traffic takes. Latency differs from bandwidth: bandwidth tells you how much data fits through the pipe per second, while latency tells you how quickly the first response arrives. In the cloud, techniques such as placing data centers close to users and using a CDN noticeably reduce latency.

LDAP

LDAP stands for Lightweight Directory Access Protocol, an open standard for querying and managing data in a directory, such as users, groups, computers and their attributes. It underpins many identity systems, including Microsoft Active Directory, and is widely used for centralized sign-in and for managing access rights. In the Google world, Google Cloud offers the Secure LDAP service, which lets older, on-premises applications that only speak LDAP authenticate against Google Cloud Identity. That keeps a legacy application usable while user management moves to the cloud. Because LDAP exposes sensitive account data, an encrypted connection over LDAPS or TLS is essential, as are tightly configured access rights on the directory itself.

Least privilege

Least privilege is the security principle that every user, service, or process is granted only the minimum permissions needed to perform its task, and no more. By keeping access tightly constrained, damage stays limited when an account is compromised or a mistake occurs: an attacker or a leak can only reach what was strictly necessary to grant. The principle calls for deliberate, fine-grained permission assignment, avoiding overly broad administrator roles, and periodically removing rights that are no longer needed. Ideally, permissions are granted temporarily and on demand rather than permanently. In Google Cloud and Workspace you apply this through IAM with specific roles at the appropriate level, and together with secret management and network segmentation it forms the basis of a defense in depth.

Legacy systeem

A legacy system is an outdated information system or application that is still in use, often because it underpins business-critical processes. Such systems frequently run on old technology or programming languages, are hard to maintain, and are well understood by only a handful of people. Replacing them is risky and costly, which leads organizations to keep them longer than is ideal. The downside is that legacy systems can introduce security risks and are difficult to integrate with modern cloud services. When moving to Google Workspace or Google Cloud, legacy mail servers, on-premises applications and outdated authentication methods are often the hardest part of the migration and call for a careful phase-out plan.

Less Secure Apps

Less Secure Apps was the term Google used for older applications that signed in with just a username and password, without modern security such as OAuth or multi-factor authentication. Think of outdated mail clients, scripts or devices that connected directly with your Google password. Because such access is vulnerable to password theft and phishing, Google has phased out this option for Google Workspace and consumer accounts. Applications must now sign in through OAuth 2.0, and where that is not possible you can use app passwords in combination with two-step verification. Blocking less secure apps significantly reduces an organization's attack surface.

License

A License determines which edition, and therefore which features, a user has available within Google Workspace. Each plan, for example Business Starter, Business Standard, Business Plus or Enterprise, unlocks its own set of services, storage and security options. An administrator assigns licenses through the Admin console, either per user or automatically per organizational unit, and can also revoke them or switch them to a different tier. The number of assigned licenses partly determines the cost of a subscription, so sound license management benefits both the budget and security: unused or departed accounts should have their license removed. Alongside the base license there are add-on licenses for specific capabilities such as extra storage or advanced security.

Lint

Linting is the automatic checking of source code for errors, suspicious constructs and style deviations before the code is run or merged. A linter analyses the code statically, meaning without executing it, and flags things like unused variables, likely bugs, unsafe patterns and departures from the agreed coding style. This catches problems early and keeps a codebase consistent, even when several people work on it. Well-known examples are ESLint for JavaScript and TypeScript and flake8 or Ruff for Python. In the context of Google Cloud, linting often runs automatically in a CI/CD pipeline, for instance in Cloud Build, so that code with errors or style issues is blocked before it can be merged.

llama.cpp

llama.cpp is an efficient implementation, written in C and C++, for running language models locally, with the explicit aim that this should also be possible on an ordinary processor without a heavy graphics card. The project focuses strongly on quantised models, allowing large language models to fit within the memory of everyday hardware while still responding reasonably quickly. Where available it also supports acceleration via a GPU, but its strength lies in broad usability across a wide range of systems. llama.cpp forms the foundation beneath many more user-friendly tools and uses the GGUF file format for models. For anyone wanting control over how a local model runs, it is a widely used base.

LLM

LLM stands for Large Language Model: a type of AI model trained on vast amounts of text, which enables it to understand and generate human language. An LLM repeatedly predicts the most likely next piece of text based on what came before, allowing it to answer questions, summarize, translate, write code and hold conversations. The models are based on the transformer architecture and contain billions of parameters that are tuned during training. Well-known examples include Google's Gemini, OpenAI's GPT and Meta's Llama. Within Google Workspace, LLMs are the engine behind the Gemini assistant, which can draft text, summarize emails and assist in Docs, Gmail and other apps. An important caveat is that an LLM sometimes produces convincing but incorrect answers, known as hallucination, so its output always warrants review.

LM Studio

LM Studio is a desktop application that lets you search for, download, run and test open language models locally through a graphical interface, without needing the command line. You pick a model, download it, and then chat with it in a window that resembles an ordinary chat app. In addition, LM Studio can start a local server so your own applications can call the model. It supports GGUF models among others and runs on the common operating systems. For anyone wanting to explore or compare local AI without a technical setup, LM Studio offers an accessible, visual way to try out models while all data stays on your own device.

Load Balancer

A load balancer distributes incoming network traffic across multiple servers, so that no single server becomes overloaded and the service stays available and fast. It acts as a traffic controller for your application: user requests arrive at the load balancer first, which then intelligently forwards them to the server with the most capacity or the best location. If a server fails, the load balancer automatically routes traffic to the remaining servers, greatly improving reliability. It also enables horizontal scaling: you simply add servers behind the load balancer to handle more visitors. On Google Cloud, Cloud Load Balancing is a globally scalable service that provides this for both web-facing and internal services.

Login Challenge

A Login Challenge is an extra verification step that Google presents when a sign-in looks suspicious, for example from an unfamiliar device, an unusual location or after several failed attempts. Instead of letting someone straight in, the system asks for additional proof of identity, such as a code from the Google app, an SMS, a security key or the answer to a recovery question. This prevents a stolen password alone from being enough to gain access. Together with two-step verification, login challenges form an important layer in Google Workspace account security. Administrators can shape the behavior in part through policy, and users reduce the chance of unnecessary challenges by maintaining trusted devices and up-to-date recovery details.

Lokale LLM

A local LLM is a large language model that runs entirely on your own computer or server, without sending input to an external cloud. Because the processing happens locally, your prompts and data never leave your own environment, which brings advantages for privacy, data protection and working with sensitive or confidential information. Latency can also be lower, and you stay independent of an internet connection or external per-use costs. The trade-off is that you need sufficient memory and compute yourself and take on the management. Tools such as Ollama and LM Studio, and projects such as llama.cpp, make running a local LLM accessible.

Looker Studio

Looker Studio is Google's free tool for creating interactive dashboards and reports, formerly known as Data Studio. You connect data sources such as Google Sheets, BigQuery, Google Ads, and Analytics, then build charts, tables, and filters that update automatically with the underlying data. Reports are easy to share, much like a Google document, and several people can view them at once. It is meant to present raw figures in an understandable way to support decision-making, without requiring readers to know the source data. For Workspace and Cloud users it is a low-threshold way to visualize data; for heavier modeling there is the broader, paid Looker platform.

M

Mail gateway

A mail gateway is a server that inspects all of an organization's inbound and outbound email before the traffic is allowed through. The gateway scans messages for spam, phishing, viruses and malicious attachments, enforces policy rules such as blocking or quarantining suspicious mail, and can also help prevent data leaks. It thereby forms a central security layer between the internet and employees' mailboxes. Some organizations deploy a dedicated gateway for their mail environment, whereas Google Workspace delivers many of these functions built in through Gmail spam filtering, advanced phishing protection and the rules in the admin console. If desired, an external gateway can be placed before or after Gmail through mail routing.

Mail Relay

A Mail Relay is a server that forwards email on behalf of other systems, so that messages from, for example, applications, printers or scanners go out through a trusted mail channel. Within Google Workspace the SMTP relay service plays this role: devices or software that are not themselves full mail servers hand their message to Google, which then delivers it on behalf of your domain. This is handy for automated notifications and system mail, and it ensures outgoing mail carries the right authentication. That is precisely why a relay is a sensitive point for security: without restrictions on permitted IP addresses, required authentication and correctly configured SPF, DKIM and DMARC, an open relay can be abused to send spam or phishing under your name.

Mailinglijst

A mailing list is an email address that automatically forwards an incoming message to all members of the list, so that a single email reaches an entire group at once. It differs from an ordinary group in that it often involves discussion or newsletters where members can reply to one another or subscribe and unsubscribe themselves. In Google Workspace you typically achieve this with Google Groups, which lets an administrator manage members, permissions and moderation. Because a mailing list forwards messages and sometimes adds a subject prefix or footer, the original DKIM signature can break; standards such as ARC exist precisely to preserve the authentication of such forwarded mail.

Mainframe

A mainframe is a powerful central computer that dates back to the era before PC networks and is built for large-scale, reliable data processing. Mainframes excel at handling huge numbers of transactions per second with very high availability and strong security, and often run for years without interruption. Although many regard them as outdated, they are still in use at organizations with intensive processing needs, such as banks, insurers, airlines, and governments, where reliability and continuity are critical. In modern IT strategies, mainframe systems are often connected to or gradually migrated toward the cloud, so that existing core applications are preserved while new services run elsewhere.

Malware

Malware is an umbrella term for malicious software designed to damage systems, steal data or quietly take control of a device. It comes in many forms, such as viruses, worms, trojans, spyware and ransomware, which encrypts data and demands a ransom. Malware often spreads through email attachments, infected downloads or deceptive links, which is why phishing and malware are closely related. Within Google Workspace, built-in protections help guard against infection: Gmail scans attachments, Google Drive checks files and Safe Browsing warns about dangerous websites. Even so, awareness remains crucial, because no filter is completely watertight. Not opening unexpected attachments, keeping software up to date and using strong authentication significantly reduce the risk.

Managed Browser

A managed browser is a browser, in practice usually Google Chrome, that is centrally configured and monitored by the IT department. Through Chrome Browser Cloud Management or the Google Admin console, administrators set policy for all devices at once: allowed or blocked extensions, mandatory security settings, enforced updates and restrictions on certain features. They also gain insight into which browser versions and extensions are running across the organization. This makes browsing safer and more consistent without each user having to configure anything themselves. For companies that work with Google Workspace and web-based tools, a managed browser is an important instrument for security and policy compliance.

Mbox

An mbox is a file format that stores an entire mailbox as a single flat text file: all messages sit one after another, each separated by a From line that marks the start of a new message. It is widely used to archive or export mail, for example through Google Takeout, Thunderbird or an IMAP backup, making it a convenient way to keep your correspondence safely outside a mail provider. Because an mbox quickly grows to hundreds of megabytes or even several gigabytes, it is hard to open in an ordinary text editor; instead use a mail client or the Cloud Captains Mbox Viewer, which indexes the file and makes it searchable by sender, subject, date and content without having to load it entirely into memory.

MCP

MCP stands for Model Context Protocol, an open standard that defines how AI models connect to external tools, files and data sources in a uniform way. Rather than building a bespoke connector for every combination of model and system, an MCP server exposes standardised access that any MCP-compatible client can use. The protocol was introduced by Anthropic and has since gained broad support. For an AI agent this means it can reach a calendar, a document store or an internal database through one consistent contract. It makes integrations reusable and tidy, but, like any connector, it demands careful management of access rights and authentication.

MFA

MFA (Multi-Factor Authentication) is a security method that requires a user to provide at least one additional proof of identity beyond their password when signing in. That extra factor comes from a different category, such as something you have (an authenticator app, a physical security key or a code by SMS) or something you are (a fingerprint). Because an attacker then needs more than just a stolen or guessed password, MFA greatly reduces the risk of account takeover. In Google Workspace you enable and enforce MFA, there called 2-Step Verification, through the Admin Console; passkeys and hardware security keys are the most phishing-resistant options available.

Microservices

Microservices is an architectural style in which an application is built from many small, independent services, each handling a well-defined task and communicating through lightweight interfaces such as HTTP APIs or message queues. Each service can be developed, tested, deployed and scaled on its own, often by a dedicated team and in its own technology. This brings flexibility and makes large systems more manageable than a monolith, where everything is tightly bound together. The trade-off is added complexity in network traffic, monitoring and data coordination between services. Microservices are commonly packaged in containers and managed with an orchestrator such as Kubernetes. On Google Cloud you typically run them on Google Kubernetes Engine or as separate Cloud Run services, optionally with a service mesh handling traffic and security between them.

Migration

Migration is the process of moving data, accounts or entire services from one system to another. In a Google Workspace setting this usually means transferring email, calendars, contacts and files from an existing environment such as Microsoft 365, Exchange or an IMAP server into Gmail, Google Calendar and Google Drive. Google provides tooling for this, including Google Workspace Migrate and the data migration service in the Admin console. A successful migration depends on careful preparation: mapping out which data must move, informing users, running a test batch and verifying that nothing is lost. Solid planning limits downtime and prevents staff from temporarily losing access to their information.

Minify

Minifying means shrinking source code such as JavaScript, CSS or HTML by stripping out everything that is not needed to run it: redundant whitespace, line breaks, indentation and comments, and for JavaScript often shortening variable names as well. The code stays functionally identical, but the file becomes smaller, so web pages download faster and load more quickly for the visitor. Minification is a standard step in virtually every modern build pipeline and usually goes hand in hand with compression such as gzip or Brotli. In the context of Google Cloud and web hosting, minified and compressed code contributes to better performance scores and lower bandwidth, and is often combined with caching through a CDN.

MITM

MITM stands for Man-in-the-Middle, an attack in which an adversary secretly positions themselves between two communicating parties to eavesdrop on, intercept or quietly alter traffic. Both sides believe they are talking directly to each other while everything actually passes through the attacker. Classic examples include eavesdropping on an open Wi-Fi network or forging DNS or certificate data. The main defense is properly implemented encryption with verified certificates, such as HTTPS over TLS, optionally reinforced with certificate pinning. Because traffic to and from Google services is encrypted with TLS by default, passive eavesdropping is made far more difficult.

Mixture of Experts (MoE)

Mixture of Experts (MoE) is a model architecture in which the network consists of several specialised sub-networks, the experts, while a routing mechanism activates only a small number of those experts per input. This allows a model to hold a very large number of parameters, and thus a lot of capacity, without having to compute all of them for every query. The result is a favourable balance between quality and compute cost: powerful where needed, yet more efficient than an equally large model that is always fully engaged. MoE is used in various large language models and helps providers, including Google with its Gemini models, combine scale with affordable inference.

Mobile Management

Mobile management is the central administration and protection of smartphones and tablets that access company data. In Google Workspace this is handled through Endpoint management in the Admin console, letting administrators enforce policies such as a mandatory screen lock, strong passcode, encryption and the ability to remotely wipe a lost or stolen device. There is a distinction between basic management, which works without an extra app, and advanced management, which gives more control over apps and settings. This keeps company data protected even when employees use their own devices, and lets an administrator selectively remove only the work data without touching the user's personal information.

Mobile Sync

Mobile sync keeps email, contacts and calendars automatically aligned between the cloud and a smartphone or tablet. A change on one device, such as a new appointment or a message marked as read, then appears almost instantly on the others. In Google Workspace this runs through the Google apps or via the Google Sync protocol for certain clients. Administrators can govern mobile management and synchronization from the Admin console and enforce rules, such as a mandatory screen lock or the ability to remotely wipe company data if a device is lost or stolen. This keeps employees productive on the go while company data stays protected.

MTA-STS

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that enforces that inbound mail to your domain is always delivered encrypted over TLS. Without MTA-STS an attacker could tamper with the connection and strip the encryption, leaving messages readable as they cross the network. With a published MTA-STS policy, sending servers know they must use TLS and find a valid certificate, otherwise the message is not delivered. The policy has three modes: none disables it, testing checks but rejects nothing while reporting problems, and enforce refuses delivery without a valid TLS connection. The advised rollout is testing first to surface issues through TLS reporting, then enforce. Google Workspace supports MTA-STS for inbound mail.

mTLS

mTLS stands for mutual TLS and is an encrypted connection in which not only the server but also the client proves its identity with a certificate. In ordinary TLS only the server presents its identity and the client stays anonymous; with mTLS both parties verify each other before any data is exchanged, so mutual authentication and encryption are established in a single step. This prevents an unknown or spoofed client from simply connecting and fits well within a zero-trust approach, where no party is trusted in advance. It is widely used for service-to-service traffic between microservices and for APIs with strict requirements. In Google Cloud, offerings such as Anthos Service Mesh and BeyondCorp support mTLS to mutually authenticate internal communication.

MTU

MTU stands for Maximum Transmission Unit and indicates the largest amount of data that fits in a single network packet without having to be split up. For most Ethernet networks this value defaults to 1500 bytes. If data does not fit in one packet, it is fragmented into smaller pieces, which can add overhead and delay. A misconfigured MTU is a well-known cause of slow or stalling connections, especially with VPNs and tunnels where extra headers reduce the usable space. Carefully tuning the MTU along the entire path prevents unnecessary fragmentation and keeps throughput optimal.

Multimodaal

Multimodal describes an AI model that handles more than one type of input or output, so alongside text it can also understand and relate images, audio or video. Instead of separate models for each modality, such a model reasons over, say, a photo and a question about it within a single context. Gemini is a well-known example: you can supply a screenshot, a document or a voice clip and receive a text answer in return. Within Google Workspace and Google Cloud this enables practical uses such as summarising a PDF that contains charts, describing an image, or acting on spoken instructions, without you having to switch between specialised tools yourself.

MX Record

An MX record (Mail Exchange) is a DNS setting that specifies which mail server is responsible for receiving email for a domain. When someone sends a message to an address on your domain, the sending server checks DNS for the domain's MX records and delivers the mail to the designated server. Each MX record carries a priority value: a lower number means higher preference, so backup servers can take over if the first one is unreachable. To use Gmail with your own domain, you point the domain's MX records to Google's mail servers. Incorrect MX records are a common cause of mail failing to arrive, so getting the configuration right is essential.

N

NAT

NAT stands for Network Address Translation, the technique that lets multiple devices in a private network share a single public IP address to reach the internet. The router rewrites the source and destination addresses in the packets and keeps a table of which internal device belongs to which connection, so replies return to the right machine. NAT eases the shortage of public IPv4 addresses and, as a side effect, provides an initial layer of protection because internal addresses are not visible from outside. In Google Cloud, Cloud NAT allows instances without their own public IP address to still send outbound traffic to the internet, for example to fetch updates, without being reachable themselves.

Node (Kubernetes)

A node is a worker machine within a Kubernetes cluster, physical or virtual, on which the pods running the actual applications live. Each node has a container runtime and Kubernetes components that receive and carry out instructions from the cluster's control plane, such as starting and monitoring pods. The cluster automatically distributes the workload across the available nodes based on capacity and rules, and can move pods elsewhere when a node fails. By adding or removing nodes you scale the total capacity up or down. In Google Kubernetes Engine, nodes are usually virtual machines on Compute Engine, grouped into node pools that can scale automatically.

NotebookLM

NotebookLM is an AI research assistant from Google that bases its answers on sources you upload yourself, such as documents, PDFs, websites, or notes. Rather than drawing on general knowledge, NotebookLM stays grounded in your material and points back to the passages it used for each answer, so you can verify the information. This makes fabricated facts less likely than with an open chatbot. It is handy for quickly making sense of large amounts of text, producing summaries, asking questions about your own material, and even generating a spoken audio overview. For knowledge workers in Workspace it is a practical way to get a grip on your own sources.

NPU

An NPU (Neural Processing Unit) is a chip designed specifically to run the calculations behind neural networks quickly and efficiently. Unlike a general-purpose processor (CPU), an NPU is optimized for the many parallel multiplications that AI models require, offering a favorable balance between performance and power consumption. NPUs now appear in modern laptops, phones, and tablets, where they enable on-device AI: think of speech recognition, image processing, and assistants that run locally without sending data to the cloud. That is faster, works offline, and is better for privacy.

O

OAuth

OAuth (Open Authorization) is an open standard that lets a user grant an app or service access to their data held by another service, without sharing their password. Instead, a temporary access token is issued that may only perform the specifically permitted actions. With Google you encounter this in the familiar consent screen that lists what data a third-party app wants to reach, for example your calendar or Drive files. The user stays in control and can revoke granted access at any time through their Google account. OAuth separates authentication from authorization: it governs what an app may do, not who you are. This keeps the password safely with the original service and limits the impact of a compromised app to the rights it was given.

OAuth Scope

An OAuth scope describes exactly which permissions an application receives when a user grants it access through OAuth. Instead of sharing a password, the user consents to clearly bounded actions, for example only reading the calendar or sending email on their behalf. Each scope represents such a specific level of access, and the guiding principle is that an app should request no more permissions than strictly necessary (least privilege). In Google Workspace, administrators can decide which third-party apps and scopes are allowed and block sensitive scopes, to prevent data leaks and abuse by untrustworthy apps. Reviewing the scopes an app requests is therefore an important security control.

Offboarding

Offboarding is the structured process of closing a user account when an employee leaves the organization or moves out of a role. In Google Workspace this includes suspending or deleting the account, revoking access to apps and data, transferring ownership of Drive files and calendars to a colleague, and setting up an automatic reply or forwarding for incoming email. A careful offboarding process is above all a security matter: it prevents a former employee from retaining access to company data and ensures valuable files and knowledge are preserved for the organization. Many administrators suspend an account temporarily before permanently deleting it, so that data can still be secured.

Ollama

Ollama is a free tool that lets you run open language models locally on your own machine with a simple command. After installation you pull and start a model with a single instruction, and you can interact with it through the command line or a local API. Ollama handles downloading models, loading them into memory and serving them, so you do not need to dig into the underlying mechanics. It runs on macOS, Linux and Windows. For anyone experimenting with local AI or wanting to deploy a language model in a privacy-friendly way without sending data to a cloud, Ollama is an accessible starting point that your own scripts and applications can also call.

On-device AI

On-device AI refers to artificial intelligence that runs directly on your own device, such as a laptop, phone or a unit with a dedicated NPU, rather than in a cloud data centre. Because the computation happens locally, data stays on the device, the feature often works without an internet connection, and response times are typically short. Examples include smart keyboard suggestions, in-camera image processing or speech recognition that works offline. What distinguishes it from a local LLM on a server is the emphasis on the user's own end device. The downside is that devices are limited in memory and compute, so on-device models are often smaller or quantised.

On-premises

On-premises (often shortened to on-prem) refers to software and servers that an organization runs itself, on its own or rented premises such as a server room or data center. It is the counterpart to the cloud, where the provider manages the underlying hardware. With on-premises you keep full control over equipment, updates, security and maintenance, but you also bear all the costs and responsibility for power, cooling and hardware replacement. Many organizations combine both models in a hybrid setup. When migrating to Google Workspace or Google Cloud, an on-premises mail server or application typically moves to a provider-managed service, so you no longer maintain that hardware yourself.

Onboarding

Onboarding is the process of adding a new user to an organization and getting them up to speed. On the technical side in Google Workspace this means an administrator creates an account, places it in the right organizational unit, assigns licenses and group memberships and arranges access to the required apps and shared drives. Onboarding also covers setting up security such as two-step verification and granting the appropriate permissions. Good onboarding ensures a new employee can be productive from day one with the right tools, while the correct security and policy settings are applied straight away. Many organizations automate these steps to ensure consistency and reduce manual errors.

Open relay

An open relay is a misconfigured mail server that forwards messages for anyone, including senders who have no connection to the server or its domain. A properly configured server only relays mail for its own authenticated users or its own domains. An open relay is a serious security risk because spammers and fraudsters abuse it to send mail in bulk under someone else's name, which quickly lands the server's IP address on blocklists and stops legitimate mail from being delivered. Modern mail platforms such as Google Workspace are not open relays by default; sending requires authentication. Anyone running their own mail server should restrict relaying to trusted, authenticated connections.

Open-weights model

An open-weights model is an AI model whose trained weights are publicly available for download, such as Meta's Llama or the models from Mistral. Because you hold the weights yourself, you can run the model locally or in your own cloud environment, fine-tune it on your own data, and use it without sending every request to an external API. That benefits privacy, cost control, and ownership. Note the distinction from fully open-source: open-weights means the weights are available, but the license may still restrict how you use them, and the training data or training recipe is often not included.

Organizational Policy

Organizational policy refers to the central rules and settings an administrator defines to govern how users, devices and services behave across an organization. In Google Workspace you manage this largely through organizational units in the Admin console, deciding per department or group which features are on or off, which security requirements apply and which apps are available. Google Cloud additionally offers the Organization Policy Service, which lets you apply enforceable constraints at the level of the whole organization, folders or projects, such as restricting certain regions or mandating specific configurations. In this way organizational policy provides consistency, compliance and control over a large or distributed environment without configuring every setting by hand for each user.

Orkestratie

Orchestration is the automatic coordination of many separate parts so they function together as a whole. In modern infrastructure it usually means container orchestration: a system such as Kubernetes schedules containers onto machines, scales them up or down according to load, restarts components that fail and manages the networking and storage between them. This frees an administrator from manually starting or monitoring each container. Orchestration also covers broader workflows, such as running data or deployment tasks in the right order with their dependencies. On Google Cloud, Google Kubernetes Engine is the managed orchestration service, while Cloud Composer, built on Apache Airflow, orchestrates data workflows. It is the difference between individual instruments and a conductor who makes them play together.

OU

An OU (organisational unit) is a structural element in Google Workspace that groups users into a tree so you can apply settings and policies in a targeted way. From the Admin Console you can decide per organisational unit which services are available, which security rules apply and which apps users may use. Child OUs inherit their parent's settings by default unless you explicitly override them, enabling fine-grained administration. This lets you give a department, location or a group of interns a different configuration without affecting the rest of the organisation. OUs mainly govern settings and policy; for sharing files or mailing lists you use groups, which operate separately.

OWASP

OWASP stands for the Open Worldwide Application Security Project, a non-profit that publishes free knowledge, tools and guidelines on application security. Its best-known publication is the OWASP Top 10, a regularly updated list of the most common and high-impact web application vulnerabilities, such as injection, broken access control and security misconfiguration. OWASP also maintains the ASVS verification standard and a separate Top 10 for risks specific to large language models. Developers and security teams use these resources as a reference to build and assess software more securely, regardless of platform or cloud provider.

P

Packet

A packet is a small unit of data in which information is sent across a network. When you transmit a message, file, or web page, it is split into many separate packets that each travel independently across the network and are reassembled into the correct order at the receiving end. Besides the actual data, every packet carries a header with information such as the source and destination address and a sequence number, so it can find its way and the whole can be reconstructed correctly. This division makes networks efficient and robust: packets can follow different routes, and a lost packet can be resent on its own. It is a core concept behind protocols such as IP and TCP.

Passkey

A passkey is a modern sign-in method that fully replaces the password. Instead of something you have to remember, it uses a cryptographic key pair based on the FIDO and WebAuthn standards. The private key stays securely on your device and is unlocked with your fingerprint, face recognition or the device PIN; only the public key is stored by the service. Because no password is sent or stored, passkeys are resistant to phishing, reuse and provider data breaches. Google supports passkeys for signing in to Google accounts and Workspace, where logging in is often faster and safer than a password combined with two-step verification. Passkeys can be synced across devices through the cloud or bound to a single device.

Password Policy

A password policy is the set of rules an organization defines to ensure users choose and use secure passwords. In the Google Workspace Admin console an administrator can set requirements such as a minimum length, enforcement of strong passwords, how long a password remains valid and whether reuse of previous passwords is allowed. The policy can also require a new user to change their password at first sign-in. A well-considered password policy reduces the chance of accounts being cracked through weak or guessed passwords. In modern security a password policy is best combined with two-step verification or passkeys, because a password on its own rarely offers sufficient protection these days.

Patch management

Patch management is the structured process of identifying, assessing, testing, and deploying software updates to close known vulnerabilities in time and keep systems stable. It goes beyond installing the occasional update: it involves an ongoing cycle of inventorying which software runs, tracking which patches are available, prioritizing by risk, verifying that an update breaks nothing, and then confirming the rollout. Good patch management shrinks the window in which attackers can exploit a known flaw, a window that is often decisive in breaches. In a cloud and Workspace environment, part of this is handled by the provider, while you remain responsible for your own VM images, containers, and application dependencies. Automation and clear agreements on response times make the process reliable.

Payload

The payload is the actual content of a request or message: the data you want to send or receive, separate from the technical wrapping around it such as headers, addressing and metadata. In an API call the payload is often the JSON block in the body of a POST or PUT request, and in a messaging system it is the real content that flows through the queue. Distinguishing the payload from its envelope helps when reasoning about size, validation and security, because the payload is exactly the part that must be carefully checked. In the context of Google Cloud and AI you encounter payloads as the input and output of model calls and as the body of messages in services such as Pub/Sub.

PDOK

PDOK (Publieke Dienstverlening Op de Kaart, roughly 'Public Services on the Map') is a Dutch platform that provides government open geospatial data and map services from a single point of access. Run in cooperation between organisations including the Kadaster (the national land registry) and Geonovum, it offers up-to-date, authoritative datasets such as aerial imagery, the official address and buildings register (BAG), topographic maps and elevation data. The data is free to use and delivered through standardised web services such as WMS, WMTS and WFS, so developers and organisations can load it directly into their own mapping applications, GIS software or websites. PDOK is thus a widely used source of spatial information in the Netherlands, for example in location analysis, real estate, logistics and government applications.

Pentest

A pentest, short for penetration test, is a controlled and authorised simulated attack on systems, applications, or networks, carried out by security experts. The goal is to find and exploit vulnerabilities the way a real attacker would, but within agreed boundaries and with the owner's permission. This reveals which weaknesses are actually exploitable and what the potential impact is, before malicious actors get the chance. A pentest ends with a report containing findings, a risk assessment, and concrete recommendations. Tests can be black-box, grey-box, or white-box, depending on how much prior knowledge the testers receive. A pentest is a point-in-time snapshot and complements ongoing measures such as patching, monitoring, and secure development.

Phishing

Phishing is a form of online fraud in which attackers try to extract confidential information such as login credentials, passwords or payment details. This usually happens through emails, messages or fake websites that impersonate a trusted party, for example a bank, a colleague or Google itself. The victim is lured into clicking a link or entering details on a counterfeit sign-in page. Gmail has advanced filters that automatically detect much phishing and display warnings, but technology alone is not enough: user vigilance remains crucial. Effective protection combines awareness, checking the sender and links, and strong authentication such as two-step verification or passkeys, which prevents a stolen password from granting immediate access.

Pod

A pod is the smallest unit that Kubernetes schedules and manages: one or more closely cooperating containers that run together on the same node and share the same network and storage. Containers within a pod reach each other over localhost and share a single IP address, which makes them a logical whole. A pod often holds a single main application, sometimes accompanied by a helper container that, for example, processes logs or supplies configuration. Pods are deliberately ephemeral: on failure or during a new rollout they are replaced by fresh instances, typically driven by a higher-level object such as a Deployment. In Google Kubernetes Engine, pods are the building blocks from which scalable applications are assembled.

Poort

A port is a numbered channel on a computer or server that lets multiple network services be reachable at the same time through a single IP address. When data arrives, the operating system uses the port number to direct the traffic to the right application. Some numbers are conventionally tied to well-known services, such as 443 for secure web traffic (HTTPS), 80 for plain web (HTTP) and 22 for SSH. Deliberately opening or closing ports through firewall rules is an important part of security: only the ports that are genuinely needed should be open, keeping a server's attack surface small.

POP3

POP3 (Post Office Protocol version 3) is an older protocol for retrieving email from a mail server to a local program. A defining trait of POP3 is that messages are by default downloaded to the device and then often removed from the server, so the mail effectively lives on a single device. This makes it less suitable for anyone who wants to read email on multiple devices, since there is no synchronization. For that purpose IMAP is a better choice, because messages then stay on the server and remain consistent across all devices. Gmail supports POP3 for those who still need it, for instance to pull mail into an older program, but for modern day-to-day access IMAP or the Gmail app is preferred.

Port forwarding

Port forwarding tells your router or gateway to send traffic arriving on a specific port through to a particular device inside your local network. Because devices behind NAT are normally not reachable directly from the internet, port forwarding lets a service such as a web server, game server, or camera become accessible from outside through your public IP address and the chosen port. You define a rule that maps, for example, port 443 to a fixed internal address. Opening a port widens your attack surface, so keep the rules minimal and pair them with a firewall. In Google Cloud you achieve a comparable effect through firewall and load-balancing rules rather than a classic home-router setting.

Postmaster Tools

Postmaster Tools is a free Google service that gives senders of larger email volumes insight into how Gmail receives and assesses their messages. After verifying your sending domain, you can see data such as the spam rate users report, the reputation of your domain and IP addresses, how much traffic is authenticated through SPF, DKIM and DMARC, and any delivery errors. This lets you spot deliverability problems early and adjust before your emails start landing in the spam folder en masse. Postmaster Tools is especially useful for organizations sending newsletters, transactional mail or large campaigns, and it complements a properly configured authentication setup on a Workspace domain.

PowerShell

PowerShell is Microsoft's command-line shell and scripting language, built to manage Windows, servers and cloud services and to automate tasks. Unlike traditional shells, PowerShell works with objects rather than plain text: its commands, called cmdlets, pass structured data that you can filter and manipulate further, enabling powerful automation. Administrators use it for everything from user management and server configuration to driving Microsoft 365 and Azure. For several years now PowerShell has also been cross-platform, running on macOS and Linux through PowerShell Core. In a mixed IT environment you can use PowerShell alongside tools for Google Cloud, and Google provides its own modules and the gcloud CLI to manage Google Cloud resources, which can be invoked from PowerShell scripts.

Privilege escalation

Privilege escalation is the abuse of a flaw or weakness to gain more rights than were officially granted. In vertical escalation an ordinary user moves up to, say, administrator or root; in horizontal escalation someone gains access to the data or actions of another user at a similar level. It is often an intermediate step in a larger attack: after an initial, limited foothold an attacker seeks higher privileges to expand control, disable defences, or reach sensitive data. Causes include misconfigured permissions, unpatched vulnerabilities, or weak isolation. Defence relies on the principle of least privilege, careful access management, timely patching, and monitoring for suspicious changes in rights.

Project (GCP)

In Google Cloud a project is the fundamental unit that bundles the resources, billing, access permissions and settings of a particular system or team. Almost everything you create, such as virtual machines, databases, storage and APIs, belongs to exactly one project, which has a unique project ID and project number. The project forms the boundary within which IAM permissions, quotas and billing apply, letting you cleanly separate work by environment (for example development, test and production) or by customer. Projects can be grouped under folders and an organization, so you can manage policies and costs clearly at a larger scale.

Prompt

A prompt is the instruction, question or text you give an AI model to elicit a response or result. It is the starting point of every interaction with a language model: it can be a short question, an elaborate task with examples, or a combination of role description, context and the desired output format. The quality and precision of the prompt largely determine how useful the answer is, because the model responds purely to what it is given. In Google Workspace, for instance, you give a prompt to Gemini in Docs or Gmail to draft, summarise or rewrite text. The more concretely you describe the goal, the tone and the constraints, the more targeted the model's help will be.

Prompt Engineering

Prompt engineering is the deliberate practice of designing, testing and refining prompts to obtain more consistent and reliable results from a language model. Rather than hoping for a good answer, you structure the input on purpose: clear instructions, relevant context, examples of the desired result and requirements for tone and format. Common techniques include assigning a role, breaking a task into steps, and few-shot examples that demonstrate what the output should look like. For anyone working with Gemini in Google Workspace or the Vertex AI models in Google Cloud, prompt engineering is the way to achieve repeatable quality without having to retrain the model itself. It is an iterative process: you adjust the prompt based on what the model returns.

Prompt-injectie

Prompt injection is an attack technique against AI applications in which an attacker hides malicious instructions inside the input to make a language model ignore its original rules or system prompt. The text the model processes then contains commands such as ignore all previous instructions, causing it to produce unwanted output, leak confidential data, or perform actions its builder intended to block. The risk is especially high with indirect injection, where the instructions arrive through content the model processes automatically, such as an email, web page, or document. For Gemini and other AI assistants within Google Workspace and Google Cloud, this means you should never blindly trust text supplied by users or external sources. Defense centers on strictly separating instructions from data, limiting the permissions of the AI agent, and filtering both input and output.

Provisioning

Provisioning is the automatic creation, configuration and management of user accounts and resources, so this does not have to be done manually for each user. In Google Workspace this means, for example, that new employees automatically receive an account, the right licenses and group memberships, often linked to a central HR system or identity provider. Through standards such as SCIM and integrations with single sign-on, accounts can be created and updated automatically, and revoked again when someone leaves; the latter is called deprovisioning. Automatic provisioning saves administrators a great deal of work, prevents errors and keeps access rights consistent and up to date. It is therefore a key part of both efficient administration and security, since outdated or forgotten accounts pose a risk.

Proxy

A proxy is an intermediary server that forwards network requests on your behalf: instead of contacting a destination server directly, your request first goes to the proxy, which then carries it out and returns the response. This middle step is useful for filtering unwanted sites, for caching where frequently requested content is stored locally to speed things up, and for anonymity because the destination server sees the proxy's address instead of yours. A reverse proxy works the other way around: it sits in front of your own servers, distributes incoming traffic, adds security, and handles tasks such as encryption.

Pub/Sub

Pub/Sub is the messaging service of Google Cloud that lets systems communicate in a decoupled way by exchanging messages instead of calling one another directly. A sender publishes messages to a topic, and one or more receivers consume them through a subscription, without both sides needing to be online or equally fast at the same time. This publish/subscribe model keeps components independent, so they can scale separately and a burst of messages can be absorbed without slowing the sender down. Pub/Sub is widely used for processing events, connecting microservices and feeding data and analytics pipelines, and can deliver large volumes of messages reliably.

Q

QoS

QoS stands for Quality of Service: a set of techniques that let a network give priority to important or time-sensitive traffic over less urgent traffic. By classifying and prioritizing traffic, QoS ensures that applications such as video calls, internet telephony (VoIP) and live streaming keep running smoothly, even when the connection is busy. The network then reserves bandwidth or places sensitive packets at the front of the queue, keeping delay, variation in arrival time (jitter) and packet loss to a minimum. QoS is especially valuable on links with limited capacity, where different kinds of traffic would otherwise compete for the same bandwidth.

Quantisatie

Quantisation is a technique for making an AI model smaller and faster by storing the numbers it computes with, the weights, at lower precision. Instead of, say, 16-bit or 32-bit floating-point values, a quantised model uses something like 8-bit or 4-bit values. As a result the model takes up less memory and runs faster, at the cost of a limited loss of accuracy. This matters especially for local models, because it makes it feasible to run a large language model on an ordinary laptop or a modest server. Tools such as llama.cpp and formats such as GGUF are strongly geared towards running these quantised models.

Quarantine

Quarantine is a temporary, isolated holding area where suspicious or potentially harmful messages are kept instead of being delivered straight away. In Google Workspace an administrator can configure quarantines through compliance and routing rules in the Admin console, so that mail matching certain criteria, such as spam signals, sensitive content or risky attachments, is intercepted first. An administrator then reviews the items and decides whether a message is still delivered, deleted or returned to the sender. Quarantine therefore reduces the risk of phishing, malware or unwanted content reaching an inbox, while legitimate messages are not permanently lost. This makes it an important administrative control for both security and compliance with internal rules.

R

RAG

RAG stands for Retrieval-Augmented Generation, an approach in which an AI model first retrieves relevant documents or passages from a knowledge source and then supplies them as context when generating an answer. Instead of relying solely on what was stored during training, the model grounds its answer in current, specific information looked up at the moment of the question. This strongly reduces hallucinations and makes answers traceable back to the source used. Retrieval is usually done through embeddings and a vector database that searches by meaning. RAG is the standard way to make a general-purpose language model work with your own, confidential or constantly changing data, such as an internal knowledge base, without retraining the model itself. In Google Cloud you build this with Vertex AI Search and embedding models.

Rainbow table

A rainbow table is a precomputed table that maps hash values back to their original passwords, letting an attacker quickly look up a stolen hash instead of recomputing each password from scratch. The technique uses clever reduction chains to store huge numbers of possibilities compactly, trading memory against computation time. Rainbow tables were effective against unsalted hashes of common passwords. The defense is straightforward: salting every password with a unique random value makes each hash distinct, so a general-purpose table becomes worthless and the attack is rendered useless in practice.

Ransomware

Ransomware is malicious software that encrypts files or entire systems and then demands a ransom in exchange for the decryption key. Increasingly it is paired with threats to leak stolen data, known as double extortion. Infection commonly occurs through phishing emails, vulnerable internet-facing services or compromised credentials. It is one of the most damaging forms of malware because it can bring an organization's operations to a complete standstill. The strongest protection combines regular, isolated backups, prompt patching, strong authentication and user awareness. Paying is discouraged, since recovery is not guaranteed and it further encourages criminals.

Rate limiting

Rate limiting is the practice of capping how many requests a user, app or IP address may make to a service or API within a given time window. It protects against abuse, overload and sudden traffic spikes, and helps share capacity fairly across all users. Common techniques include the token bucket and sliding window approaches, where a server that detects an overrun usually returns a 429 status code along with information about when you may try again. In the context of Google Cloud and AI services, almost every API enforces quotas and rate limits, expressed for example in requests per minute or tokens per minute, so you should build your code to back off and retry gracefully rather than repeatedly hitting the limit.

RCE

RCE stands for Remote Code Execution and is one of the most severe classes of security flaw. It lets an attacker run their own code or commands on a target system from a distance, often without physical access and sometimes without valid credentials. Anyone who achieves RCE can effectively take over the system: steal data, plant malware, pivot to other systems on the network, or take the service down. RCE arises from a range of causes, such as insecure deserialisation, command injection, vulnerable uploads, or flaws in dependencies. Because of its high impact, RCE vulnerabilities usually receive a high CVSS score and top priority for patching. Defence centres on timely updates, strict input validation, sandboxing, and least privilege.

RDP

RDP stands for Remote Desktop Protocol, Microsoft's protocol for taking over and controlling the desktop of another Windows computer remotely, as if you were sitting in front of it. Screen, keyboard and mouse are relayed over the network, allowing administrators to maintain servers or users to work remotely. RDP uses port 3389 by default. Because an RDP port exposed directly to the internet is a favorite target for attackers, RDP should always be shielded behind a VPN, a gateway or strict firewall rules and protected with strong authentication. On Google Cloud you preferably reach Windows VMs on Compute Engine through Identity-Aware Proxy rather than opening RDP directly, so that access stays shielded and controlled.

Recovery Email

A recovery email is an alternate email address linked to an account, used to regain access when you are locked out, for instance after a forgotten password or a suspicious sign-in. Google sends a verification code or recovery link to this address so you can confirm your identity and set a new password. It is important that the recovery email belongs to a different account than the one being recovered and that you still have access to it; an outdated or unreachable recovery address can make account recovery impossible. Alongside a recovery email, Google also offers other recovery options such as a recovery phone number. For business Workspace accounts, account recovery is usually handled by the administrator, who can reset passwords.

Recovery Phone

A recovery phone is a phone number linked to an account that is used to regain access when you forget your password or get locked out. For a Google account this number can receive a verification code by text message or a prompt to confirm your identity, and it also helps Google flag suspicious sign-ins. In addition it acts as an extra layer of security, because unusual activity can be reported to this number. It is wise to keep a recovery phone up to date and to choose a number only you can access, since whoever controls the number may in some cases be able to recover the account. In a Workspace environment administrators often encourage users to set up recovery options to reduce lockouts and support workload.

Red team

A red team is a group of security experts that attacks an organisation the way a real, persistent adversary would, in order to test its defences realistically. Unlike a classic pentest, which often targets specific systems and known vulnerabilities, a red team works toward goals and scenarios: it tries, for example, to reach certain data or systems, combining technical attacks with social engineering and physical routes. Its counterpart, the blue team, defends and detects; collaboration between the two is called purple teaming. The outcome shows how well people, processes, and technology together notice and repel attacks, and it yields concrete improvements for detection and response.

Reflected XSS

Reflected XSS is a form of Cross-Site Scripting where malicious input from a request (such as a query string in a link or a submitted form) is sent straight back into the HTML of the response by the server without being properly filtered or escaped first. The script then runs in the victim's browser. Unlike stored XSS, the payload is not saved anywhere; it lives in the attack link itself, which the victim must click. Attackers use this to steal session cookies, perform actions on the user's behalf, or tamper with the page. The main defences are context-aware output encoding, strict input validation, and a Content Security Policy that restricts inline scripts.

Regex

Regex is the short name for regular expression: a compact string that describes a pattern you can use to search, validate, split, or replace text. With special characters you define what you are looking for, such as a run of digits, a word at the start of a line, or the shape of an email address. Regex is extremely powerful for text processing, but the syntax is dense and can be hard to read, so careful testing pays off. Nearly every programming language and many tools support regex, with small differences in dialect between them. Within Google Workspace and Google Cloud you encounter regex in filters, in search queries, and when defining data and validation rules.

Remote Wipe

Remote wipe is an administrative capability that erases data from a lost, stolen or decommissioned device without the device having to be physically present. In Google Workspace this is done through device management (endpoint management) in the Admin console, where an administrator can perform a full wipe, which resets the device to factory settings, or a selective wipe that removes only the corporate account and its associated data while leaving personal data intact. This limits the risk of company information falling into the wrong hands when a phone or laptop goes missing. Remote wipe is therefore a core part of a sound mobile device and data protection policy, especially in environments where staff use their own devices.

Reply-To

Reply-To is an email header that determines which address a reply is sent to by default, even when that differs from the original sender address in the From field. If for instance you send mail from a no-reply or system address but want responses to reach a team or help desk, you put that address in Reply-To. When the recipient clicks Reply, the mail client automatically fills in that address instead of the sender. It is a convenience feature, not a security measure: phishers can abuse Reply-To to quietly redirect replies to a different address. In Gmail and Google Workspace you can set a Reply-To, for example per alias, so that replies arrive at the intended address.

Reproduceerbare build

A reproducible build is a build process that, from exactly the same source code with the same tool versions and settings, always produces a bit-for-bit identical result. Because the final product is fully predictable, anyone can independently verify that a published binary or container image truly corresponds to its source code, with no hidden changes. This is a key building block for trust and security in the software supply chain, because it makes tampering during the build observable. In practice it requires locking dependencies, eliminating non-deterministic elements such as timestamps and random ordering, and pinning versions. In a CI environment such as Cloud Build it supports verifiable provenance and aligns well with supply-chain integrity frameworks.

Reranking

Reranking is a step in search and retrieval systems where an initial set of retrieved results is reordered by relevance before being used further. A fast first retrieval step, for example based on vector similarity, often yields many roughly matching candidates; a more precise reranking model then judges each result more carefully against the query and puts the best ones on top. This significantly improves the quality of the final selection. In retrieval-augmented generation (RAG), reranking matters because only the most relevant pieces of context are passed to the language model, which produces better answers. Within Google Cloud, reranking is available as part of the search and RAG capabilities in Vertex AI.

Retention Rule

A retention rule defines how long data must be kept and what happens to it once that period ends, whether it is deleted automatically, archived, or actively protected from deletion. In Google Workspace you configure retention rules through Google Vault, where you can specify per service such as Gmail, Drive, or Chat that messages and files are preserved for, say, seven years before they may be removed. Retention rules help organisations meet legal record-keeping obligations and internal governance policies, and they prevent users from accidentally erasing information the organisation is still required to produce.

Retrieval-Augmented Generation

Retrieval-Augmented Generation, or RAG for short, is a technique that combines information retrieval with text generation by a language model. When a question comes in, the system first looks up the most relevant sources, for example in a document collection or vector database, and supplies them as context to the model. The model then formulates an answer grounded in those retrieved passages rather than relying only on knowledge from its training. The major benefit is that hallucinations decrease sharply and answers stay current and traceable, even when the underlying data changes. It also lets you use sensitive or company-specific information without retraining the model. RAG is the standard architecture behind many enterprise AI search and assistant solutions, and in Google Cloud you can implement it using Vertex AI Search, among other tools.

Reverse proxy

A reverse proxy is a server that sits in front of your actual backend servers: clients send their requests to the proxy, which forwards them on behalf of the servers behind it and returns the response. Unlike a regular forward proxy, which shields clients, a reverse proxy shields the servers. It is a common place to handle tasks such as load balancing across multiple instances, caching frequently requested content, TLS termination, and filtering out malicious traffic. Well-known examples include Nginx and HAProxy. In Google Cloud, the HTTP(S) Load Balancer essentially plays a reverse-proxy role by distributing traffic across backend services and managing SSL certificates.

Role Assignment

A role assignment is the act of linking a predefined role with a specific set of privileges to a user or group. Instead of granting individual permissions one by one, you assign a role that bundles a coherent package of rights. In the Google Workspace Admin console this is how you delegate administrator access: you might grant someone the Help Desk Admin or User Management role, optionally scoped to a particular organisational unit. Role assignments support the principle of least privilege and keep oversight manageable, so you can control who can do what without handing everyone full super administrator access.

Rollback

A rollback is the act of reverting to a previous, known-good version of software, configuration or infrastructure after a new release causes problems. The goal is to contain the impact of a failed deployment quickly and restore service without waiting for a new fix to be built. A sound rollback strategy requires that earlier versions are retained and that changes, such as database migrations, are reversible or at least compatible with the older code. Strategies like blue-green and canary make rollbacks especially fast, because you simply switch traffic back. On Google Cloud you can revert to an earlier revision in Cloud Run, and with infrastructure-as-code such as Terraform you roll back to a previously known state. A dependable rollback is a cornerstone of safe and frequent deployment.

Router

A router is a device that connects different networks and decides which path data packets take to reach their destination. Using the destination IP address and a routing table, the router selects the next hop each time, so traffic travels along the most suitable route from one network to another. At home a router often combines several functions, such as linking your local network to the internet, providing wireless access and acting as a firewall. In larger environments and at providers, routers together form the backbone that makes the internet work, reliably forwarding packets between countless networks.

S

S/MIME

S/MIME (Secure/Multipurpose Internet Mail Extensions) is a standard for digitally signing and encrypting email using certificates. A digital signature proves that a message genuinely comes from the sender and has not been altered in transit, while encryption ensures that only the intended recipient can read the content. S/MIME relies on certificates from a public key infrastructure (PKI) issued per user; sender and recipient each need the other's public key to communicate in encrypted form. In Google Workspace, hosted S/MIME is available in higher-tier plans, letting administrators deploy certificates centrally and enforce policy. It offers stronger protection than Confidential Mode for organizations with strict confidentiality requirements.

SaaS

SaaS stands for Software as a Service: software you consume as an online service through a subscription, rather than installing and maintaining it yourself on your own computers or servers. The provider runs the application in the cloud, handles updates, security, and backups, and you simply use the software through your browser or a lightweight app. This removes large investments in hardware and in-house maintenance, and you typically pay per user per month. Google Workspace is a well-known example, with Gmail, Docs, Sheets, and Drive running entirely online. SaaS is one of the three main forms of cloud services, alongside IaaS (infrastructure) and PaaS (platform), and for many organizations it is the most direct and accessible way to use software.

Safety settings

Safety settings are configuration options that determine how strictly an AI model blocks or allows potentially harmful or inappropriate content. For each category, such as hate speech, harassment, explicit content or dangerous instructions, you set a threshold ranging from light to very strict filtering. This lets you tune the model's behaviour to the context of your application: an internal development tool may warrant different limits than a public chatbot. In the Gemini API on Google Cloud you configure these safety settings per request, and the model can block or flag content when a threshold is exceeded, helping you work with generative AI safely and responsibly.

Salting

Salting is the practice of adding a unique, random value, the salt, to a password before it is processed by a hash function. As a result, two users with the same password still end up with completely different hashes because their salts differ. This prevents attackers from reusing precomputed hash lists such as rainbow tables and forces each password to be cracked individually. The salt itself does not need to be secret and is simply stored alongside the hash. Salting is standard practice for secure password storage and is usually combined with a deliberately slow algorithm such as bcrypt, scrypt or Argon2.

SAML

SAML stands for Security Assertion Markup Language, an open, XML-based standard for securely exchanging authentication and authorisation data between an identity provider and a service provider. SAML is the backbone of many Single Sign-On setups: the identity provider issues a signed assertion confirming that a user has authenticated, and the service provider then grants access without prompting for a password again. The current version is SAML 2.0. Google Workspace can act as a SAML identity provider for third-party SaaS applications, and can equally let users sign in through an external SAML provider, so staff reach multiple systems with a single set of credentials.

Sandbox

A sandbox is a walled-off, isolated environment where you can try out software, scripts, or configurations without errors spilling over into your real production environment. Because the sandbox is separated from live systems and data, a failed test or even malicious code cannot cause lasting damage. In Google Workspace and Google Cloud you might use a sandbox to test an Apps Script integration, a new security policy, or an AI prompt before rolling it out across the whole domain. It is essentially a safe space to experiment, learn, and contain risk before a change is made permanent.

Sandbox-escape

A sandbox escape is a vulnerability that lets code break out of an isolated, heavily restricted environment, the sandbox, and gain access to the underlying operating system or other processes. A sandbox is designed to run untrusted code, such as a web page, a browser tab or an uploaded attachment, in isolation so that any damage stays contained. If the isolation can be bypassed, that protection collapses and the attacker can reach much further than intended. Sandbox escapes are considered serious and are a key reason to keep browsers, operating systems and cloud runtimes promptly patched whenever a fix is released.

Scheduled task

A scheduled task is a task in Windows that runs automatically at a set time or in response to a particular event, such as the computer starting up or a user signing in. Through Task Scheduler or with PowerShell you define what should run, a script or program, and under which conditions, so that recurring work like backups, cleanups or reports happens without manual intervention. It is the Windows equivalent of a cron job on Linux. In a cloud environment this idea moves to managed schedulers: on Google Cloud, Cloud Scheduler triggers HTTP endpoints, Cloud Functions or Pub/Sub messages on cron-like schedules, letting you run scheduled tasks serverlessly and reliably without maintaining a machine of your own.

Secret management

Secret management is the secure storage, administration, and distribution of sensitive values such as passwords, API keys, certificates, and database credentials, kept separate from source code. The goal is to prevent secrets from ending up in plain text in code, configuration files, or version control, where they easily leak. A sound approach offers encrypted storage, fine-grained access control, automatic rotation, and an audit trail showing who requested which secret and when. Applications then retrieve the secret at runtime instead of hard-coding it. In Google Cloud, Secret Manager fills this role, integrating with IAM for permissions and Cloud Logging for auditing. It ties closely to the principle of least privilege, so each service receives only the secrets it genuinely needs.

Security Key

A security key is a small physical device, often in the form of a USB, NFC or Bluetooth stick, that acts as a strong second factor when signing in. Instead of typing a code, you confirm your sign-in by touching or inserting the key, which then uses cryptography to prove that it really is your key. Because the key is bound to the correct domain, it offers powerful protection against phishing: a spoofed login page cannot complete the verification. Google supports security keys based on the FIDO standards, including the Titan Security Key, and through the Advanced Protection Program offers an extra strict level of security for high-risk groups. In Workspace administrators can enforce the use of security keys for sensitive accounts.

Service Account

A service account is a special type of account that does not belong to a person but to an application, virtual machine or script, so that software can authenticate and act on its own behalf. In Google Cloud a service account is an identity within IAM with its own email address, to which you assign precise roles and permissions following the principle of least privilege. Instead of passwords it typically uses keys or, preferably, short-lived tokens and workload identity to authenticate more securely without long-lived secrets. Service accounts enable automation and server-to-server communication, for example an application writing data to a storage bucket. Good management is essential, because overly broad permissions or leaked keys of a service account pose a serious security risk.

Session Control

Session control covers the rules and settings an organization uses to determine how and for how long users stay signed in and under what conditions an active session remains valid. In Google Workspace an administrator can set the duration of web sessions, so that users must sign in again after a certain period, and with Context-Aware Access can make access depend on factors such as location, device status or IP address. A session can thus be blocked or restricted when the context does not meet the conditions. Session control helps reduce the risk that an unattended or compromised device retains access for a long time, and it allows a better balance between convenience and security, especially with sensitive data or access from unknown networks.

Shared Drive

A shared drive is a central storage location in Google Drive that belongs to a team or organisation rather than to an individual user. As a result, files in a shared drive remain in place even when the employee who created them leaves the company or has their account deleted. Access is managed at the level of the drive itself, so every member automatically works with the same set of files. Shared drives, formerly called Team Drives, are ideal for project assets and company documentation that should be owned collectively by the team instead of being scattered across personal folders.

Shared Mailbox

A shared mailbox is an inbox that several users can read and manage together, so a team can collectively handle incoming messages. Typical examples are addresses such as info@, support@, or sales@, where any authorised colleague can reply to the mail that arrives. In Google Workspace you usually set this up using a Google Group with collaborative inbox features, or through delegated access that lets colleagues read and send on behalf of the account. A shared mailbox prevents messages from getting stuck with one absent person and keeps customer communication continuous and evenly distributed across the team.

SIEM

SIEM stands for Security Information and Event Management: a system that collects, normalizes, and centrally analyzes logs and security events from across the network to detect threats. By bringing together data from servers, applications, network devices, and cloud services, a SIEM can correlate individual events that look harmless on their own but together indicate an attack. The system generates alerts, supports post-incident investigation, and helps demonstrate that security and compliance obligations are being met. A SIEM is therefore a cornerstone of a security operations center. In the Google ecosystem, Google Security Operations, which evolved from Chronicle, fulfills this function at cloud scale, with capabilities for detection, investigation, and response across large volumes of telemetry.

Sign-In Alert

A sign-in alert is an automatic notification sent the moment a suspicious or unusual login to an account is detected, such as a sign-in from an unfamiliar device, a new location, or a country where the user does not normally log in from. In Google Workspace the system generates these alerts, and administrators can monitor them centrally through the security centre and the alert centre. The notification gives both the user and the administrator a chance to react quickly, for example by changing the password or ending the session, helping to catch compromised accounts at an early stage.

Single Sign-On

Single Sign-On, abbreviated SSO, is a method that lets a user access multiple systems and applications with a single set of credentials, without having to log in again each time. After authenticating once with a central identity provider, downstream applications automatically trust the user through standards such as SAML or OpenID Connect. This improves convenience and reduces password fatigue, while security stays centrally enforceable. In Google Workspace a Google account can serve as the central identity for numerous connected SaaS services, so employees reach every approved tool with the same sign-in and administrators can revoke access from one place.

Smart Compose

Smart Compose is a Google AI feature that completes your sentences as you type. Based on the context and commonly used phrasing, it suggests the likely continuation of your sentence, which you can accept with the Tab key. The aim is to help you write faster with fewer typos and less repetition. Smart Compose appears in products such as Gmail and Google Docs, where it fills in things like standard opening and closing lines or frequent expressions. The suggested text is always optional: you can ignore any suggestion and simply keep typing, so you remain fully in control of the final content of your message or document.

Smart host

A smart host is a fixed outbound mail server through which all of an organization's messages are routed before they go out to the internet. Instead of each mail server or application delivering directly itself, they hand their mail to this single central server. This makes it possible to filter, log, sign and secure outgoing mail in one place, and it simplifies managing reputation and deliverability. The term is often mentioned alongside SMTP relay, since a smart host effectively acts as a relay point. With Google Workspace you can use the SMTP relay service or a mail gateway as a smart host, so that all outbound traffic is sent in a controlled and consistent way.

Smart Reply

Smart Reply is a Gmail feature that automatically suggests short, ready-made responses based on the content of a received message. A few prepared replies typically appear at the bottom of the email, such as a brief confirmation or a thank-you, which you can send with a single click or tweak before sending. It saves time on simple, recurring messages and is especially handy on mobile devices where typing is more cumbersome. The suggestions are generated by AI from the context of the conversation, and you are never obliged to use them: you can always write a completely custom reply yourself.

SMTP

SMTP stands for Simple Mail Transfer Protocol and is the standard protocol used to send email across the internet and to relay it between mail servers. When you send a message, your mail program hands it over via SMTP to an outgoing server, which then routes it to the recipient's server; to retrieve mail, clients instead use protocols such as IMAP or POP. SMTP typically runs over port 587 or 465 with TLS encryption, and modern sending relies on authentication and on standards such as SPF, DKIM and DMARC to counter spoofing and spam. In Google Workspace applications and devices often use the SMTP relay or Gmail's SMTP server to reliably send email through the company domain.

SMTP-relay host

An SMTP relay host is an intermediate mail server to which you send outgoing email, so that this server then delivers the message to the recipient on your behalf. This is useful when devices or applications, such as printers, scanners, web servers or business software, may not or cannot send mail directly themselves. By routing everything through a relay, you keep sending centralized, can enforce authentication and security, and prevent individual devices from ending up on a blocklist. Google Workspace offers an SMTP relay service for this, letting verified systems from your organization reliably send mail through Google's infrastructure, with the correct SPF, DKIM and DMARC settings for deliverability.

Social engineering

Social engineering is the manipulation of people, rather than the exploitation of technology, to obtain access, information or money. The attacker preys on trust, authority, helpfulness or time pressure, for example by impersonating a colleague, a manager or a help desk employee. Common forms include phishing, phone-based deception and impersonating an executive to force a payment. Because the human is targeted rather than the system, technology alone is not enough. The best defense combines awareness and training, clear procedures for verifying requests, and technical safety nets such as two-step verification and phishing-resistant passkeys.

Spam Filter

A spam filter is a system that evaluates incoming email and stops unwanted or harmful messages before they reach the inbox. It analyses signals such as sender reputation, suspicious links, known phishing patterns, and the content of the message, then moves dubious mail to a separate spam folder or blocks it entirely. Gmail features an advanced, machine-learning-based spam filter that intercepts vast volumes of unwanted messages every day. In Google Workspace, administrators can further tune the filtering behaviour with custom rules, allowed and blocked sender lists, and additional checks, so the filter aligns with the organisation's security policy.

Spam Quarantine

Spam quarantine is a specific storage location where messages flagged as spam or otherwise unwanted are held, so that they do not reach the inbox directly. In Google Workspace an administrator can use Gmail settings and routing rules in the Admin console to decide which messages go to quarantine and who may review them. From the quarantine an administrator can still release a message to the user or delete it permanently, which helps correct false positives without letting real spam through. Spam quarantine thus reduces exposure to unwanted advertising, phishing and possible malware, while legitimate senders are not simply lost. It therefore strikes a practical balance between clean inboxes and the assurance that important email can still be retrieved.

SPF

SPF (Sender Policy Framework) is an email authentication standard that uses a DNS record (a TXT record on your domain) to declare which mail servers are authorised to send messages on that domain's behalf. When a receiving server accepts a message, it checks the sending IP address against the SPF record to judge whether the sender is legitimate. Its purpose is to curb spoofing, where attackers forge addresses from your domain. In Google Workspace you add the SPF record at your domain provider, typically including Google's servers (include:_spf.google.com). SPF works best alongside DKIM and DMARC; on its own it is not enough, partly because it can break when mail is forwarded.

SQL-injectie

SQL injection is an attack in which malicious input is processed inside a database command, allowing an attacker to manipulate the intended query. It happens when an application concatenates user input directly into a SQL string instead of keeping data separate from code. As a result an attacker can read data they should not see, modify or delete records, bypass authentication, and sometimes even run commands on the server. It remains one of the most persistent and dangerous web vulnerabilities. The effective defence is to use parameterised queries or prepared statements, combined with strict input validation and the principle of least privilege for the database account, so that damage stays limited if something does go wrong.

SSH

SSH (Secure Shell) is an encrypted protocol for working with a remote server securely, usually via the command line. Everything that passes between your computer and the server, including credentials and commands, is encrypted, so no one can eavesdrop or tamper with the traffic. You can log in with a password, but a safer and more common method is a key pair: a private key you keep and a public key stored on the server. Besides a shell, SSH also lets you transfer files and tunnel connections. For managing virtual machines in Google Cloud, SSH is the standard way to gain access.

SSRF

SSRF stands for Server-Side Request Forgery. In this attack a server is tricked into making requests on the attacker's behalf to destinations it should not be able to reach, such as internal services, admin interfaces, or metadata endpoints. The attacker supplies, for example, a URL that the application then fetches, abusing the server's trust and network position to reach shielded systems. In cloud environments SSRF is notorious because it can grant access to internal metadata services and therefore to temporary credentials. The defence consists of strictly validating and allowlisting permitted destinations, blocking internal IP ranges, and limiting outbound traffic from servers.

Stateless

Stateless describes a design in which a service retains no data between successive requests: each request carries all the information needed to process it on its own. Because no single instance holds unique session data, all instances are interchangeable, which enables easy horizontal scaling, load balancing and effortless replacement of failed copies. State that does need to persist, such as sessions or user data, is moved to an external facility like a database, a cache or a token. This principle aligns closely with the REST style and is a prerequisite for serverless platforms. In Google Cloud, Cloud Run for example expects stateless containers, so the platform can freely start, stop and scale instances down to zero.

Stored XSS

Stored XSS, or stored cross-site scripting, is an attack in which malicious script code is permanently saved on a website, for example in a comment, profile field or forum post, and is then automatically executed in the browser of every visitor who opens the page. Unlike reflected XSS, the victim does not need to click a crafted link; the code already resides in the stored content. This makes it one of the most dangerous variants, because an attacker can steal session cookies, perform actions on behalf of the user, or tamper with the page. The defence is consistently validating input and, above all, correctly escaping output for each context, complemented by a Content Security Policy to limit the impact.

Subadres (plus-adressering)

Subaddressing, also known as plus addressing, is a handy technique where you add a plus sign and a label of your own choosing after the name in your email address, for example name+shop@example.com. All mail still arrives in the same mailbox as name@example.com, but thanks to the label you can easily filter, label or forward incoming messages. It is especially useful for tracking which party used your address: give each website a unique label and you immediately see who shared or leaked your details if spam arrives on that label. Gmail and Google Workspace support plus addressing by default. Bear in mind that some web forms incorrectly reject the plus sign.

Subnet

A subnet, or subnetwork, is a delimited portion of a larger IP network that you define separately to separate traffic and keep management clear. By dividing a network into subnets you can isolate different departments, environments, or types of devices, limit broadcast traffic, and apply security and routing rules more precisely. The size of a subnet is set with a subnet mask or CIDR prefix such as /24. In Google Cloud, a VPC consists of one or more subnets, each tied to a region and assigned its own IP range; you place virtual machines inside them and attach firewall rules and routes, forming the basis of a structured cloud network.

Super Admin

A Super Admin is the highest administrator role within Google Workspace and holds full control over the entire organisation. The role can create or delete users and groups, manage security settings and billing, assign other administrator roles, and oversee every organisational unit. Because of this far-reaching power, a super administrator account is also an attractive target for attackers. It is therefore wise to deliberately keep the number of super admins small, protect these accounts with strong multi-factor authentication, and use more limited roles for everyday work in line with the principle of least privilege.

Supply chain attack

In a supply chain attack the adversary does not target the victim directly but instead goes after a supplier, service or software component the victim depends on. By compromising, for example, a widely used software library, an update mechanism or a build pipeline, the attack spreads automatically to every organization that uses the tainted component. This makes such attacks broad and hard to detect, because the malicious element arrives through a trusted source. Defenses include verifying packages and their provenance, pinning versions in lockfiles, scanning for vulnerabilities and limiting dependencies to reliable, well-maintained sources.

Suspicious Login

A suspicious login is a sign-in attempt that deviates from the normal pattern and may indicate account abuse. Signals that can point to this include a sign-in from an unusual location or a new device, at an atypical time or via an unfamiliar IP address. Google analyzes such activity and can send a warning, request an extra verification step, or block the sign-in until you confirm it is really you. In Google Workspace administrators can use security alerts, the security dashboard and the investigation tool to detect and respond to suspicious logins, for example by ending sessions or forcing a password reset. Responding quickly to a suspicious login reduces the chance that a hijacked account causes further damage.

Switch

A switch is a device that connects multiple devices within the same network and forwards data to the correct port. Unlike a router, which links different networks together, a switch operates within a local network and forwards data frames based on the recipient's MAC address. Because the switch remembers which device is attached to which port, traffic goes only to its intended destination rather than to every device at once, making the network more efficient and faster. Switches are therefore the links through which computers, servers, printers and access points within a building communicate with one another.

Sync

Sync is short for synchronisation and means that the same data is automatically kept identical across two or more locations, such as a device and the cloud. The moment you change a file on your laptop, that change is propagated to your other devices and to online storage, so you always work with the same version everywhere. In Google Workspace you see this with Drive for desktop, which links local folders to Google Drive, and with Gmail, Calendar and Contacts that stay aligned across phone, browser and web client. Synchronisation usually runs in both directions and resolves conflicts by keeping the newest or merged version, making collaboration and switching devices seamless.

System Prompt

A system prompt is the hidden base instruction that defines the behaviour, role, tone and boundaries of an AI assistant, separate from the individual questions a user asks. Whereas the user prompt changes from one conversation to the next, the system prompt stays active in the background and governs how the model behaves consistently: which persona it adopts, which topics it avoids and in what format it answers. Developers use the system prompt to keep a chatbot or AI feature within fixed limits, for example a support assistant that only discusses its own products. In Google Cloud, when building with Gemini through Vertex AI, you set this behaviour using system instructions. A well-crafted system prompt is therefore an important part of safety and quality control.

T

Takeout

Google Takeout is Google's official export service that lets you download a copy of your own data from Google products. You choose per product what to include, for example Gmail messages, Drive files, Photos, Calendar or Contacts, and Google bundles this into one or more archive files that you retrieve through a download link. Takeout exists for data portability: it helps you create a backup or move your information to another service. In a Workspace environment an administrator can decide whether end users may use Takeout themselves, and there is also an organisation-wide export option for when a company wants to secure all of its data at once.

TCP

TCP stands for Transmission Control Protocol, one of the core protocols of the internet that delivers data reliably and in the correct order. Before any data is sent, the sender and receiver establish a connection through a so-called three-way handshake. During transfer TCP checks that every packet arrives, requests retransmission of lost packets and reassembles the data in the right sequence, while also regulating speed to avoid congestion. Because of that reliability, TCP is used for applications where completeness matters more than minimal delay, such as loading web pages, email and file transfers.

Team Drive

Team Drive is the former name for what Google now calls a Shared Drive. It refers to a shared storage space within Google Workspace whose files are owned by the team or organisation rather than an individual user. As a result, documents remain preserved and accessible when an employee leaves or their account is deleted, unlike files in a personal My Drive. Google replaced the name Team Drive with Shared Drive in 2019, but you still encounter the old term in documentation, scripts and conversations. The feature itself, with centralised management of access and ownership at the team level, has stayed the same.

Telnet

Telnet is an outdated protocol that let you operate a command line on another computer remotely, for example to manage a server. The major problem is that Telnet sends all data, including login names and passwords, entirely unencrypted over the network, so anyone intercepting the traffic can read everything. Because of this serious security risk, Telnet is no longer recommended for remote access today and has been almost universally replaced by SSH, which offers the same function but encrypts the entire connection. Telnet still occasionally appears in old equipment or for testing network ports, but for managing systems, certainly in the cloud, SSH is regarded as the secure standard.

Temperatuur (AI)

Temperature is a setting that controls how predictable or how varied a language model's answers are. Technically, it affects how strongly the model flattens or emphasises the probability of less likely next words. A low temperature produces factual, consistent and repeatable output, which is useful for tasks such as classification, extraction or following strict instructions. A high temperature yields more creative, varied and less predictable answers, suited to brainstorming or writing prose. In many AI tools and APIs, including those of Google Cloud, the temperature is adjustable so you can tune the balance between reliability and creativity to fit your use case.

Template

A template is a preset structure or configuration that serves as a starting point and can be reused repeatedly, so you do not begin from scratch each time. In practice this ranges from a document template with fixed formatting to a standard configuration for settings or infrastructure. Within Google Workspace, for example, you use templates in Docs, Sheets and Slides through the template gallery, and organizations can share their own templates for consistent branding. In a broader technical context, such as Google Cloud, templates describe a reusable setup with which you can quickly and uniformly create new environments or resources. Templates thus save time, reduce the chance of errors and promote consistency across documents, processes or systems.

Terraform

Terraform is a popular infrastructure-as-code tool from HashiCorp that lets you describe infrastructure in declarative configuration files and create, change and manage it across multiple cloud providers at once. You define the desired end state, and Terraform computes a plan showing which concrete changes are needed before it applies them, so you can see in advance what will happen. It tracks the current state in a state file, which lets it detect drift between your code and reality. Because it works through providers, you can use the same approach for Google Cloud and others, rolling out networks, virtual machines or a Kubernetes cluster reproducibly. The state file can contain sensitive data and should therefore be protected and stored securely.

Threat Protection

Threat Protection is the collection of security layers that protect users and data against attacks such as malware, phishing, malicious attachments and suspicious links. In Google Workspace this largely runs in the background of Gmail and Drive, where incoming messages and files are scanned automatically, senders are verified, and dangerous content is quarantined or sent to spam. Administrators can configure extra measures, such as stricter attachment rules, sandboxing of unknown files and warnings for external senders. The goal is to stop attacks before they reach a user, and to limit the damage if something suspicious does get through.

TLS

TLS stands for Transport Layer Security and is the standard protocol that encrypts network traffic while it is in transit between two systems. It ensures that data you send over the internet cannot be read or tampered with by third parties, and it uses certificates to confirm that you are really talking to the correct server. TLS is the modern successor to the outdated SSL and is the security behind the padlock in your browser on an https connection. In Google Workspace, TLS protects traffic to Gmail, Drive and the admin console, among others, and email between mail servers can be encrypted over TLS so that messages stay confidential in transit between organisations as well.

TLS-rapportage (TLS-RPT)

TLS reporting, or TLS-RPT for short, is a mechanism through which sending mail servers periodically report back to you whether encrypted delivery to your domain succeeded. You publish a DNS record with an address where the reports may be sent, typically once a day, and those reports show how many connections completed successfully over TLS and which ones failed, along with the relevant cause. It is an indispensable companion to MTA-STS and DANE, because without reporting you would not notice that connections silently went unencrypted or failed. This lets you spot certificate or TLS configuration problems early and fix them before they block delivery. Google Workspace supports TLS reporting for inbound mail to your domain.

Token

A token is a temporary digital key that a user or application uses to gain access to a service without re-entering a password every time. After a successful sign-in, the system issues a token that is sent along with subsequent requests to prove identity and the granted permissions. Tokens usually have a limited lifetime and can be revoked, which makes them safer than repeatedly sharing login credentials. In Google services and the Google Cloud APIs, tokens play a central role in OAuth 2.0, where access tokens grant short-lived access and refresh tokens can obtain a new access token once the old one expires.

Token (AI)

A token is the smallest unit of text in which a language model processes language; often that is a word, but just as easily a word fragment, a punctuation mark or a space. Before a model can process text, the input is split into tokens, and when generating, it produces its output token by token as well. The number of tokens matters for two reasons: it largely determines the cost of a request on paid APIs, and it counts towards the context window limit, the amount of text a model can take in at once. In the Gemini API on Google Cloud you typically pay per million tokens and must keep that context limit in mind with long documents or conversations.

TOML

TOML stands for Tom's Obvious, Minimal Language: a configuration format designed to be easy for people to read and write while mapping unambiguously to a data structure of key-value pairs. It uses clear sections in square brackets, explicit types such as strings, numbers, booleans and dates, and comment lines, which makes it less ambiguous than YAML and more compact than JSON for configuration purposes. TOML shows up frequently in modern developer tools and package managers, for example in a pyproject.toml file or in build and CI configurations. In a Google Cloud or AI project you typically reach for it to configure the tooling around your code, rather than for the data your application itself processes.

Transfer Ownership

Transfer of ownership is the process of moving ownership of a file or folder from one user to another, so that the new owner gains full control. In Google Drive you can manually transfer ownership of a document to a colleague within the same organization, after which the new owner decides who has access and the file cannot simply be deleted by others. This is especially important when an employee changes roles or leaves the organization, so that documents are not orphaned or lost. In Google Workspace an administrator can also use the Admin console to bulk-transfer files from a departing user to another user. Transfer of ownership thus safeguards continuity and clear management of company data.

Transformer

The Transformer is the neural network architecture that underpins virtually all modern language models. At its heart is the attention mechanism, which lets the model decide, for each word, which other words in the text are most relevant, regardless of their position. This allows a Transformer to process long sequences efficiently and in parallel, unlike older recurrent networks that worked word by word. The architecture was introduced in 2017 in the paper Attention Is All You Need and sits beneath models such as Gemini and most generative AI. For users of Google Cloud and AI tools it is the underlying technique that makes tasks like translation, summarisation and text generation possible.

Trust Rule

A trust rule is a policy in Google Workspace that lets an administrator control, in a granular way, how files in Google Drive may be shared internally and externally. Instead of a blunt 'external sharing on or off' choice, you can specify per organizational unit or group who may share files, who may receive them, and which trusted domains are allowed. Trusted domains are placed on an allowlist and must themselves be domain-verified. Trust rules replaced the older Drive sharing settings in late 2022 and are available in editions such as Enterprise and Education. They are a key tool for preventing data leaks caused by overly permissive sharing settings.

Trusted Device

A trusted device is a phone, laptop or tablet that the organisation has marked as known and approved, often because it is enrolled in device management and meets the security requirements. Signing in from such a device is smoother: users may, for example, be prompted for a second verification less often, or be allowed to reach sensitive resources that are blocked on other devices. In Google Workspace this ties into endpoint management and context-aware access, where an administrator links rules to the device's status. This way, trusted devices gain convenience while unknown or non-compliant devices are subjected to extra checks or kept out.

U

UDP

UDP stands for User Datagram Protocol, a fast and lightweight network protocol that sends data without first establishing a connection and without any delivery guarantee. Unlike TCP, UDP does not check whether each packet arrives and does not correct the order; lost packets are simply skipped. That saves overhead and delivers low latency, which is ideal for applications where speed matters more than perfection, such as video calls, live streaming, online games and DNS lookups. A brief glitch is less noticeable there than a perceptible delay, so the priority is throughput over full reliability.

URL Whitelist

A URL whitelist (or allowlist) is an explicit list of permitted web addresses or domains. Only traffic to the listed URLs is allowed through, while everything else is blocked by default. This default-deny approach is stricter and safer than a blacklist, because unknown or newly created malicious addresses are automatically kept out. In a Google Workspace context, whitelists are used in Chrome policies to limit which sites employees may visit, in network and firewall rules, and when authorizing specific OAuth redirect URIs. Note that many organizations now prefer the more neutral terms allowlist and blocklist over whitelist and blacklist.

User Alias

A user alias is an additional email address linked to an existing user account without needing a separate account or an extra licence. Messages sent to the alias arrive in the same mailbox as the primary address, so an employee is reachable under multiple addresses. This is useful for name changes, spelling variants or role-based addresses that should still land with a specific person. In the Google Workspace admin console an administrator adds aliases to a user, and the user can usually also choose one of those aliases as the sending address, depending on the settings.

User Provisioning

User provisioning is the automatic creation, updating, and deactivation of user accounts and their access rights. Rather than manually creating each employee in every system, provisioning synchronizes accounts from a central source such as an HR system or identity provider. When someone is hired, they automatically receive the right accounts and group memberships; when they leave, access is revoked immediately through deprovisioning. In Google Workspace this is often handled via Google Cloud Directory Sync, SCIM, or the Admin SDK, optionally tied to an external provider. Sound provisioning reduces the risk of forgotten, over-privileged, or orphaned accounts, making it an important security control.

User Suspension

User suspension is the temporary blocking of an account so that the user can no longer sign in or use the services, while their data is retained. Unlike deleting an account, email, files and settings are preserved, so access can be restored easily later. Administrators use this for departing employees, suspected misuse, a compromised account, or during an investigation. In the Google Workspace admin console an administrator suspends a user with a few clicks; the account then refuses new sessions and active sessions are terminated. Once the suspension is lifted, the user regains their access and data.

UUID

UUID stands for Universally Unique Identifier: a 128-bit code, usually written as thirty-two hexadecimal characters split into five groups separated by hyphens, used to tell records or objects apart. Its key advantage is that different systems can each generate a UUID independently, without a central counter or coordination, while the chance of a collision remains negligibly small in practice. This makes UUIDs handy in distributed systems, when merging data from multiple sources, and for identifiers you can create before a record even exists in the database. In Google Cloud you encounter UUIDs as keys for resources, messages and log entries, where global uniqueness matters more than a short, sequential number.

V

Vault

Google Vault is the eDiscovery and information governance service within Google Workspace, letting organisations retain, search and export data from services such as Gmail, Google Drive, Chat and Meet. With Vault you set retention rules that determine how long messages and files are kept, even after a user has deleted them, and you can use legal holds to preserve data relevant to litigation or audits. You can also run targeted searches and export the results for compliance or investigation purposes. Vault is therefore aimed chiefly at regulatory compliance and legal proceedings, and is available in the business and education editions of Workspace rather than as a general end-user backup solution.

Vault Hold

A Vault hold is a preservation order you place in Google Vault on accounts, organizational units, or groups to protect their Google Workspace data from deletion. A hold overrides the normal retention rules: data that users would otherwise delete or that services would purge is kept indefinitely for as long as the hold is active. It is typically used for a legal obligation to preserve evidence (a legal hold) or for compliance and eDiscovery purposes, such as during litigation or an internal investigation. For Gmail and Chat messages you can limit the hold to messages matching specific conditions. In this way Vault supports the first steps of the eDiscovery process: preserve, search, and export.

VBA-macro

A VBA macro is a piece of code written in Visual Basic for Applications that is embedded in Microsoft Office files such as Word, Excel or PowerPoint documents. Macros let you automate repetitive tasks, run calculations or process data. At the same time they are a well-known security risk: attackers hide malicious code in seemingly ordinary documents to spread malware as soon as a user enables the macro. For this reason Microsoft blocks macros by default in files that originate from the internet. Google Workspace has no VBA; Google Sheets and Docs instead use Apps Script, a JavaScript-based automation language that runs in the browser and does not carry the same document-malware risk.

Vector Database

A vector database is a database built specifically to store embeddings, that is numerical representations of meaning, and to search them for similarity at high speed. Instead of matching on exact values, such a database finds the vectors that are closest in meaning to a given query vector, often using efficient approximate nearest-neighbour algorithms. This makes the vector database the linchpin of semantic search and of Retrieval-Augmented Generation, where the most relevant passages must be retrieved for each question to feed the language model. They are also used for recommendation systems, duplicate detection and image search. In Google Cloud you can use vector search through Vertex AI Vector Search or via the vector extensions in databases such as AlloyDB and Cloud SQL for PostgreSQL.

Verification Code

A verification code is a temporary security code you enter during sign-in as extra proof that you are really you. It is usually a short sequence of digits that is valid only briefly and can be used once, which prevents reuse by others. Verification codes are a common form of two-step verification and can be received by SMS, generated by an authenticator app, or printed in advance as backup codes. In Google Workspace they strengthen the sign-in on top of the password, so that an attacker holding only a stolen password still cannot get in without also possessing the current code.

Verification Token

A verification token is a temporary, usually uniquely generated code or string used to confirm the identity of a user, device, or request. It is used for things like validating an email address or phone number, activating a new account, resetting a password, or authorizing an API call. The token is issued by a server and checked when used; because it has a limited lifetime and is ideally single-use, it limits the damage if intercepted. In a web context a related variant, the CSRF token, is used to block forged requests. A verification token must be sufficiently long and random so that it cannot be guessed or brute-forced.

Virtuele Machine

A virtual machine (VM) is a complete, software-emulated computer that runs on physical hardware and has its own operating system, including a virtual processor, memory, and disk. A software layer called the hypervisor divides the real hardware among several VMs so they can run isolated alongside one another on the same physical server. This lets you run, for example, Windows and Linux at the same time on a single machine, while a failure in one VM stays separate from the others. Virtual machines are a cornerstone of cloud computing: on Google Cloud you provision them through Compute Engine, spinning up and shutting down computing power as needed. Compared with containers, VMs are heavier but provide stronger isolation.

Visitor Sharing

Visitor sharing makes it possible to share files with external people who do not have a Google account, without requiring them to create one first. The external recipient proves their identity through a verification code sent by email, and then gains access to the shared document. This is convenient for collaborating with clients or partners who work outside Google Workspace, while the owner still keeps control over who can see what. Administrators can enable or disable visitor sharing in the admin console and apply additional restrictions, so that external access fits within the organisation's security policy.

VLAN

A VLAN (virtual LAN) is a logical division of a physical network into several separate segments, without needing extra cables or switches. Devices in the same VLAN behave as if they are on their own network, even though they share the same physical equipment. That helps with management and especially with security: you can place guests, office computers, and servers in separate VLANs, so traffic between those groups only passes through controlled rules. On the switch the segments are marked with a VLAN tag, so the network knows which segment each packet belongs to.

vLLM

vLLM is an open-source inference server that runs large language models efficiently and serves many concurrent users at once. Its core technique, PagedAttention, manages the memory for the attention computation in small blocks, so less memory is wasted and more requests fit in parallel. As a result vLLM reaches much higher throughput than a naive setup, with streaming responses and an API that is compatible with the OpenAI interface. In practice you use vLLM to self-host an open-weights model such as Llama or Mistral, for example on a GPU instance in Google Cloud, instead of paying per token through an external provider.

VMC

VMC stands for Verified Mark Certificate, a digital certificate proving that your organisation has the right to the logo you want to display next to your email. It is a requirement for BIMI at receivers such as Gmail, which do not accept a self-asserted logo and want proof that it belongs to your domain. To obtain a VMC your logo must be registered as a trademark with a recognised intellectual property office, and your domain must already have SPF, DKIM and an enforced DMARC policy in place. The logo is supplied as an SVG. Only with a valid VMC does Gmail show your logo and the accompanying verified checkmark in the inbox. Since late 2024 a cheaper Common Mark Certificate also exists, but it does not earn the blue verified checkmark in Gmail.

Volume (container)

A volume is a storage location that exists independently of a container's lifecycle, so data persists even when the container is stopped, removed or replaced by a new version. Containers are ephemeral by nature: anything written inside them disappears when they are cleaned up. For things that must survive, such as a database, uploaded files or log files, you therefore attach a volume. The same volume can often be shared across multiple containers or reattached after a restart. In Kubernetes this idea is expanded with persistent volumes, which automatically provision storage from an underlying cloud provider such as Google Cloud and bind it to pods.

VPC

VPC stands for Virtual Private Cloud: a logically isolated virtual network inside a public cloud where you run your servers, databases and other services. You define the IP address ranges (subnets), routing rules and firewall settings yourself, so resources stay shielded from each other and from the public internet unless you explicitly allow traffic. In Google Cloud a VPC is global by default, meaning a single network can hold subnets across multiple regions, which simplifies management. In practice a VPC is the foundation of secure architectures, because it lets you build segmentation, private connectivity to other services and tightly controlled access.

VPN

A VPN (Virtual Private Network) sets up an encrypted connection that routes your network traffic through a secure tunnel to a VPN server. As a result no one on the network in between, such as a public Wi-Fi hotspot, can read what you send, and your traffic appears to originate from that server's location. Companies mainly use a VPN to give staff secure remote access to internal systems as if they were in the office. Worth knowing: a VPN protects data in transit, but it does not replace strong authentication or modern zero-trust access, where every request is verified individually.

VRAM

VRAM (video RAM) is the fast memory on a graphics card where a GPU keeps the data it needs immediately. For AI, the amount of VRAM mainly determines how large a model you can run locally: the weights, the intermediate results, and the context all have to fit in that memory. A model with more parameters or higher precision needs more VRAM, while quantization can cut memory use considerably. Anyone without a card that has enough VRAM often turns to a cloud GPU instance, for example on Google Cloud, where you rent a card with the desired amount of memory by the hour.

W

WAF

A WAF, or Web Application Firewall, is a security layer that inspects HTTP traffic to a web application and specifically detects and blocks attacks at the application level. Whereas an ordinary firewall mainly operates at the network level, a WAF understands the content of web requests and can block patterns indicating SQL injection, cross-site scripting, path manipulation, and other common vulnerabilities. It works with rule sets, for example based on the OWASP guidelines, and can allow, deny, or further inspect traffic. A WAF does not replace secure coding, but forms an extra line of defense that can also cover unknown or unpatched flaws. In Google Cloud, Cloud Armor provides WAF functionality as part of the load balancer, including preconfigured rules and custom policies.

Webhook

A webhook is an automatic notification that one system sends to another over HTTP as soon as a particular event occurs. Instead of an application repeatedly asking whether something new has happened, the source actively sends a message with the relevant data to a predefined URL, the webhook endpoint. As a result, systems react to events almost immediately, which is more efficient than repeated polling. Webhooks are widely used for integrations and automation, for example to post a notification in Google Chat, trigger a workflow, or pass data to another service. The receiving side processes the incoming request and takes the desired action.

Webhook-handtekening

A webhook signature is a cryptographic verification value sent along with a webhook that lets the recipient confirm the message truly comes from the expected sender and was not altered in transit. The sender typically uses a shared secret to compute a hash, often an HMAC, over the request body and places it in a header. The recipient repeats the same computation with the same secret and accepts the message only if the signatures match. This prevents an attacker from sending forged notifications to your endpoint or tampering with existing requests. A sound implementation compares the signature in a time-constant manner and also checks a timestamp to thwart replay of old messages. Services such as payment providers and Google integrations use this pattern to authenticate webhooks reliably.

Webhook-retry

Webhook retry is the redelivery of a webhook when the first attempt fails, for instance because the receiving server is temporarily unreachable or returns an error status. The sender then retries the notification a number of times, usually with an increasing wait between attempts (exponential backoff), so that transient failures are bridged automatically without overwhelming the receiver. As a result, event notifications arrive reliably even during brief outages. An important consequence is that the same notification can arrive more than once, which means the receiver must be idempotent: processing the same webhook multiple times must not produce duplicate effects. Many services include a unique event id for this purpose, allowing you to deduplicate.

Windows-register

The Windows registry is the central, hierarchically organized database in Microsoft Windows that stores settings for the operating system, hardware, user profiles and installed programs. It is divided into root keys such as HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER, beneath which keys and values govern how Windows and applications behave. Much software reads its configuration from the registry at startup. Because it is so tightly woven into the system's operation, incorrect or accidental changes can cause instability or even prevent Windows from booting, so edits are usually left to administrators or trusted tools. On Windows workstations in a Google Workspace environment, the registry is often managed centrally through group policy or an MDM solution.

Windows-service

A Windows service is a program that runs in the background within Windows, without its own window and often even before a user logs in. Services handle long-running or system-wide tasks such as networking, print queues, security, automatic updates and keeping server applications alive. They are managed by the Service Control Manager and can start automatically when the system boots, be started manually, or be disabled. Because a service runs under its own, sometimes elevated, account, choosing the correct service account and permissions matters for security. Administrators view and manage services through the Services console or with command-line tools such as sc and PowerShell.

Work Insights

Work Insights is an administrator report in Google Workspace that shows how an organization actually uses and adopts the Workspace apps. Through clear charts, admins, managers, and HR can see, for example, how many employees are active in Gmail, Drive, Calendar, Docs, Sheets, and Slides, and how usage develops over time. This reveals whether a rollout is succeeding and where teams may need extra training. To protect privacy, Work Insights shows data only in aggregate for teams of ten people or more, not at the level of an individual employee. The feature is available in certain Workspace editions, typically the business and Enterprise tiers.

Workspace

Google Workspace is Google's business productivity and collaboration suite, formerly known as G Suite and before that as Google Apps. It bundles familiar services such as Gmail, Calendar, Drive, Docs, Sheets, Slides, Meet and Chat under a single subscription, with your own domain name for email and shared cloud storage. Administration is centralised in the Admin Console, where you manage users, security, devices and policy, including through organisational units and 2-Step Verification. Workspace comes in different editions for businesses, education and non-profits, with varying storage limits and features per edition such as advanced security, Vault for compliance and increasingly built-in AI assistance through Gemini.

Workspace Add-on

A Workspace Add-on is an extension that embeds functionality from a third-party app directly inside the Google Workspace apps such as Gmail, Calendar, Drive, Docs, Sheets, and Slides. With a single build the add-on appears as a card-based panel within multiple apps, on both desktop and mobile, so users never have to leave the Workspace environment. Developers typically build them with Apps Script or a linked Google Cloud project and publish them through the Google Workspace Marketplace. Alongside these broad Workspace Add-ons there are Editor add-ons that extend only a single editor. Add-ons make it possible to integrate, for example, a CRM, project tool, or signing solution seamlessly into the daily working environment.

Workspace Labs

Workspace Labs is a Google program that lets users try out early, experimental features in Google Workspace before they roll out broadly. These are often new AI-driven capabilities, such as writing help in Docs and Gmail or image generation in Slides, that are still very much in development. Participants get early access and can provide feedback that Google uses to refine the features before they become final. Because these are beta features, they may change or disappear again and are not meant to be a stable foundation for critical workflows. Much of what was first tested through Workspace Labs later folded into the broader Gemini offering for Workspace. The program is thus a way for Google to validate innovations with real users.

Workspace Marketplace

The Google Workspace Marketplace is the official online store where users and administrators find apps and add-ons that integrate with Google Workspace. Its catalog includes solutions from both Google and third-party developers, ranging from CRM and project management tools to e-signatures, reporting, and AI utilities. Administrators can install apps centrally for the whole domain or for specific organizational units and restrict which apps are allowed, which helps with governance and security. Before a public app becomes available it goes through a Google review process, including a check of the OAuth permissions the app requests. Administrators are well advised to allow only verified apps with appropriate scopes.

Workspace Sync

Workspace Sync, formally Google Workspace Sync for Microsoft Outlook (GWSMO), is a synchronization tool that lets people keep using Microsoft Outlook while their data lives in Google Workspace. It keeps email, calendar events, contacts, tasks and notes in two-way sync between Outlook and the matching Google account, including the Global Address List. This makes it useful during a migration to Workspace or in a hybrid setup, because staff do not have to switch mail clients overnight. Administrators typically deploy GWSMO centrally and can control which services are synced, while the tool resolves conflicts between the two environments automatically.

WSUS

WSUS stands for Windows Server Update Services: a Microsoft server role that lets you manage, approve and distribute Windows updates centrally within your network. Instead of every PC downloading updates separately from Microsoft, the WSUS server fetches them once, after which administrators decide which updates go to which groups of devices and when. This saves bandwidth and gives control over testing and rolling out patches, which matters for stability and security. WSUS is widely used in corporate networks with many Windows machines. For organizations moving to the cloud, more modern services such as Windows Update for Business and Microsoft Intune fill a comparable role, while in a Google-oriented environment ChromeOS and web-based tools handle updates largely automatically and centrally from the cloud.

X

XSS

XSS stands for Cross-Site Scripting, a common web vulnerability in which an attacker injects malicious scripts into a trusted web page that are then executed in the browsers of other visitors. This lets the attacker steal session cookies or tokens, forge user actions, or manipulate the page content. It is generally categorized as stored, reflected, or DOM-based XSS. The primary defense is to consistently escape and sanitize all user-supplied input at the point where it is rendered, reinforced by a Content Security Policy and safe templating engines. XSS has featured in the OWASP Top 10 for years and remains one of the most exploited flaws in web applications.

Y

YAML

YAML, a recursive acronym for 'YAML Ain't Markup Language', is a human-friendly data serialization format used primarily for configuration files. It relies on indentation with spaces (never tabs) to represent nested structures such as lists and key-value pairs, which makes it more readable than formats like JSON or XML. YAML is a superset of JSON and is widely used in DevOps and cloud work, for example in Kubernetes manifests, CI/CD pipelines, and deployment files for Google Cloud. A key caveat is that indentation must be exactly right, because YAML is whitespace-sensitive; values from untrusted sources should also be parsed safely to prevent injection.

Z

Zero Trust

Zero Trust is a security model built on the assumption that no user, device or network connection should be trusted by default, not even inside the corporate network. Instead of a fixed perimeter where everything inside is allowed, every access request is verified again based on identity, device posture, location and context, following the principle never trust, always verify. Access is granted as narrowly as possible, limited to exactly what is needed. In Google Cloud and Workspace this is reflected in BeyondCorp Enterprise and context-aware access, which let administrators set conditions per application and per situation for who may reach data under which circumstances.

Zero-day

A zero-day is a security flaw that is still unknown to the software's vendor or maker, which means no patch or official fix exists yet. The name refers to the fact that the maker has had zero days to address the problem. An attack that exploits such an unknown flaw is called a zero-day exploit, and it is dangerous because standard defences are not yet tuned to it. These vulnerabilities are valuable on the black market and are used in targeted, advanced attacks. Because a direct fix is missing, defence relies on mitigations: layered security, network segmentation, rolling out patches quickly once they appear, and monitoring that flags anomalous behaviour.

ZIP

ZIP is a widely used archive format that combines one or more files and folders into a single compressed file with the .zip extension. The compression reduces the overall size, which is handy for sending files faster or storing them more compactly, and the bundling preserves the folder structure. Nearly every operating system can open and create ZIP files without extra software. In Google Workspace, ZIP shows up regularly: when you download several files at once from Google Drive or retrieve a Google Takeout export, they are usually delivered as a ZIP archive that you then extract locally.

ZIP Extraction

ZIP extraction is the unpacking of a ZIP archive, a compressed file that bundles one or more files and folders to save storage space and simplify sharing. During extraction the original files are restored in their original structure. The ZIP format is platform-independent and is supported out of the box by Windows, macOS, and most operating systems. An important security aspect is that extracting archives from untrusted sources carries risks, such as path traversal (the 'Zip Slip' attack), where files are written outside the intended directory, and 'zip bombs' that consume enormous space when unpacked. Always validate the paths and sizes of archive contents before writing them to disk.