Are custom IOC feeds kept private inside my SecOps instance

They are custom and only used in your tenant.

​@cc_applications  thanks for your reply. Do you know if that is documented anywhere? I’m probably going to need that when management starts asking questions.

I think it would have been in the terms and conditions accepted as part of signing up to use Google SecOps, or the a larger Google Cloud agreement, but the Terms for SecOps are here - https://cloud.google.com/terms/secops/service-terms and Data Processing terms are here - https://cloud.google.com/terms/data-processing-addendum?hl=en  That may have language that’ll help.

Thanks again, I think I found a reference that may be what I’ve heard might be spooking people I’ve spoken to.

3. Submission of Security Content. Mandiant Solutions may allow Customer to submit Security Content or other malware to Google. Customer acknowledges that any Security Content or other malware provided by Customer through the Mandiant Solutions is not Customer Data, and may be used, aggregated, analyzed and shared by Google to enhance the products and services Google provides to its customers.