The first thing that I always share with people asking that question is a link to the Google Apps security and privacy overview. There you will find answers to the most common questions about security and privacy including perhaps the most frequently asked question, "who owns the data that organizations put into Google Apps?" Google's response is copied below.
- To put it simply, Google does not own your data. We do not take a
position on whether the data belongs to the institution signing up for
Apps, or the individual user (that's between the two of you), but we
know it doesn't belong to us!
The data which you put into our systems is yours, and we believe it should stay that way. We think that means three key things.
- We keep your data as long as you require us to keep it.
- Finally, you should be able to take your data with you if you choose to use external services in conjunction with Google Apps or stop using our services altogether.