Google Model Armor
Model Armor is a Google Cloud service that screens LLM prompts and responses for prompt injection, harmful content, sensitive data and malicious URLs.
What Google Model Armor does
Model Armor sits between an application and a language model and inspects traffic in both directions. A prompt is checked before it reaches the model and the response is checked before it reaches the user, and each call returns which filters triggered. The filters are responsible AI categories (hate speech, harassment, sexually explicit and dangerous content, each with a confidence threshold), prompt injection and jailbreak detection, sensitive data detection through Google's Sensitive Data Protection service, and malicious URL detection. It also scans text inside documents such as PDFs, and images.
Filters and thresholds are grouped into templates, and Google's guidance is to keep separate templates for prompts and for responses. A template either only inspects and logs, or inspects and blocks. Model Armor is called through its own API, so it can screen traffic for models on other clouds, and it has integrations with Google's Agent Platform, Apigee, Gemini Enterprise, Google's MCP servers and LangChain.
Google Model Armor: owner, license and hosting
| Fact | Value | Source and date checked |
|---|---|---|
| Owner | Google (Google Cloud). | SOURCE ↗ |
| License | Proprietary managed service. Google publishes no source code or license for it. | SOURCE ↗ |
| Self-hosting | No. It runs in Google Cloud. It can screen prompts and responses for applications on other cloud providers through its API. | SOURCE ↗ |
| Hosted regions | 16 regions: 6 in Europe (Madrid, Belgium, London, Frankfurt, Netherlands, Paris), 5 in North America and 5 in Asia Pacific, plus EU and US multi-regions. | SOURCE ↗ |
Each value was read from the vendor's own page on the date shown. How listings are checked
Google Model Armor plans and prices
Google Model Armor pricing, checked on . Lowest paid plan: $0.10 per million tokens beyond the 2 million free tokens a month. Free tier: Yes. No cost for up to 2 million tokens a month. Pricing model: Pay as you go, per token in the prompts and responses screened. Also included, with a monthly token allowance, in Security Command Center Premium and Enterprise.
| Plan | Price | Included usage | Beyond that | Data retention | Users |
|---|---|---|---|---|---|
| Standalone | $0 | 2 million tokens a month | $0.10 per million tokens | – | – |
| Security Command Center Premium, pay as you go | Included with Security Command Center | 2 million tokens a month | $0.10 per million tokens | – | – |
| Security Command Center Premium, subscription | Included with the subscription | 3 billion tokens a month | $0.10 per million tokens | – | – |
| Security Command Center Enterprise, subscription | Included with the subscription | 3 billion tokens a month | $0.10 per million tokens | – | – |
A token is four characters, not counting white space, and both prompts and responses count. Using Sensitive Data Protection inside Model Armor has no additional charge. Storing logs is billed separately under Cloud Logging pricing. Google's product page also lists Model Armor as included with a Gemini Enterprise subscription.
As stated on the vendor's pricing page on . A dash means the page does not say.
Google Model Armor pricing history
The pricing page has been checked daily since . No price change has been recorded since then.
Where Google Model Armor fits
Teams on Google Cloud, and teams that want a metered screening API with a free allowance: the first 2 million tokens a month cost nothing. It is priced per token rather than per filter, sensitive data detection adds no charge, and EU and US multi-region endpoints are available.
Limits of Google Model Armor
The basic sensitive data mode covers six data types that Google describes as mainly addressed to the US; anything more needs a Sensitive Data Protection template. Prompt injection detection returns no match for inputs under three words, and only the first 256 URLs in a payload are scanned. Available filters vary by region, and logs are billed separately through Cloud Logging.
Other guardrails and audit tools
-
Amazon Bedrock Guardrails
Amazon Bedrock Guardrails is a managed AWS service that filters prompts and model responses against content, topic and sensitive-data policies.
-
NVIDIA NeMo Guardrails
NVIDIA NeMo Guardrails is an open-source Python library for adding programmable input, dialog, retrieval and output checks to LLM applications.
-
OpenAI Guardrails
OpenAI Guardrails is an open-source Python library that wraps the OpenAI client and runs configurable checks on model inputs and outputs.
-
Presidio
Presidio is an open-source Python framework that detects and anonymizes personal data in text, images and structured data.