Claude on Google Cloud now has two data processors: pick carefully

New Zealand businesses on Google Cloud can now reach Claude through two routes. The two look almost identical on the invoice, but a privacy review would treat them differently. Google announced general availability of an Anthropic-managed deployment option on 23 October 2026. The new option sits beside the Google-managed Claude service that already runs inside Google's Agent Platform, formerly Vertex AI. IT Brief Australia covered the change for ANZ buyers on 6 November. Google's announcement says both routes deliver the same models on release day, at the same price, on the same Google Cloud bill. The routes differ in who handles your data, which contract applies and where requests are sent.

What changed on Google Cloud

On the Anthropic-managed route, Anthropic runs the service on Google Cloud infrastructure and acts as the data processor under Anthropic's Commercial Terms. Customers still sign in through Google Cloud IAM, keep Cloud Audit Logging and draw down their eligible Google Cloud commitments. The Anthropic-managed route also gets Anthropic's platform features on launch day, including Claude Managed Agents (still in beta), skills and code execution.

On the Google-managed route, Google Cloud stays the processor under the customer's existing agreements. Google lists VPC Service Controls, customer-managed encryption keys and "data residency in the U.S., EU, and APAC" for the Google-managed route. New Anthropic features reach Google-managed customers later, once Google has built them into its own infrastructure.

Anthropic's documentation adds details Google's blog post leaves out. Anthropic's comparison of the two offerings lists the Anthropic-managed location as global. The same comparison says Anthropic sets the rate limits, billing runs through Google Cloud Marketplace, and setup creates a new Anthropic organisation for the Google Cloud project. Anthropic's setup guide states that the new organisation is separate from any existing one, including a Claude Enterprise organisation the company already pays for.

The residency fine print for NZ workloads

Google's APAC residency claim reads differently next to Anthropic's endpoint documentation for the Google-managed service. The global endpoint sends each request to whichever region has spare capacity. Multi-region endpoints exist only for the United States and the European Union. Regional endpoints keep processing inside one named region, but they serve Claude Sonnet 4.6 and earlier models only. A team that wants Opus 5.5 or Sonnet 5.5 on Google-managed infrastructure can choose between global routing and a US or EU multi-region. The same page says multi-region and regional endpoints cost 10 percent more than the global endpoint. Neither Google's announcement nor Anthropic's documentation names a New Zealand or Australian region for Claude on Google Cloud.

AWS offers a closer-to-home option for Claude. Amazon Bedrock arrived in the Auckland region on 17 March 2026, with Claude models available through cross-region inference. AWS's technical walkthrough explains that the AU inference profile sends requests from Auckland only to Auckland, Sydney and Melbourne, while data at rest stays in the source region. The models listed at the Auckland launch were Claude 4.5 and 4.6 versions, so check AWS's current model list before assuming a newer model is covered by the AU profile.

Why the choice of processor matters under the Privacy Act

Information Privacy Principle 12 limits when a New Zealand organisation can disclose personal information to an organisation overseas. Before such a disclosure, the organisation must check that one of a short list of protections applies. Examples include the recipient doing business in New Zealand, or contract clauses that give comparable safeguards. Whether a particular AI setup counts as a disclosure depends on how the provider holds and uses the data, and your privacy officer or lawyer should make that call. Many firms already did that assessment for Google Cloud when they signed their main agreement. A switch to the Anthropic-managed route brings in a different processor under different terms, so the earlier Google assessment doesn't automatically cover Anthropic.

The bigger operational risk is how easily a team can switch routes without anyone noticing. Developers who want Managed Agents or code execution will be drawn to the Anthropic-managed route, because the Google-managed docs list both features as unsupported. Moving between the two routes means changing the SDK client in code (AnthropicGoogleCloud for Anthropic-managed, AnthropicVertex for Google-managed) and subscribing in Marketplace. Because the bill still arrives from Google, finance staff can't tell from the invoice which route a project uses. A processor decision that ought to go through procurement can end up inside a pull request.

Anthropic's comparison page gives IT leads a reliable way to see which route a project uses. Anthropic-managed requests go to claude.googleapis.com and use IAM roles named roles/claude.admin, roles/claude.user and roles/claude.viewer. Google-managed requests go to aiplatform hosts, with a URL path that includes publishers/anthropic/models.

Practical next steps

• Audit every Google Cloud project that calls Claude. Check request hosts and SDK clients against Anthropic's identification table. Then check which Marketplace subscriptions exist on your billing accounts.
• Add Anthropic to your AI processor register for any project on the Anthropic-managed route. Read Anthropic's Commercial Terms on retention and use of data, and record which business data passes through each project.
• Classify each workload before choosing a route. Global routing suits low-sensitivity drafting and code. Personal information about customers or staff, or commercially sensitive material, belongs on a pinned regional endpoint, the Bedrock AU profile, or a model you host yourself.
• Control who can enable the Anthropic-managed route. Restrict Marketplace purchase rights and the roles/claude.* IAM roles so that a new processor needs sign-off before any traffic flows.
• Price residency into the business case. Regional and multi-region endpoints carry a 10 percent premium on Google Cloud, so a cost comparison that uses global pricing understates what a compliant setup costs.
• Keep sensitive workloads off the public cloud where possible. Data that shouldn't leave your premises is better served by an on-site model. Our local AI server page covers the options.

Google hasn't said which APAC countries its Claude residency covers. Neither Google nor Anthropic has published a timeline for New Zealand or Australian processing of current models on Google Cloud. Until either company publishes that information, New Zealand organisations should treat Claude on Google Cloud as processed offshore and decide case by case. For help setting a policy on which AI routes are approved for which data, our AI consultancy team works on exactly that kind of governance.