What is Google Model Armor?
Model Armor is a Google Cloud service that checks the prompts going into a model and the replies coming out, for models on Google Cloud or anywhere else. It looks for prompt injection and jailbreak attempts, four kinds of harmful content (hate speech, harassment, sexually explicit and dangerous content), child sexual abuse material, malicious URLs and sensitive data such as card numbers, US social security numbers and Google Cloud keys. It can also screen PDFs, Word, Excel, PowerPoint, CSV and text files, and in preview single images.
You set the rules in templates, each filter at one of three confidence levels, and choose whether violations are only logged or also blocked. Floor settings let a security team set a minimum standard that every template in a project must meet. Ready-made integrations cover Google's agent platform, Gemini Enterprise, Apigee, Google Cloud networking services, Google's MCP servers and LangChain.
Used on its own, the first 2 million tokens a month are free and the rest cost $0.10 per million, where a token is about four characters. Security Command Center Premium and Enterprise include 3 billion tokens a month on subscription.
How much does Google Model Armor cost?
| Plan | Price | What you get |
|---|---|---|
| Standalone | $0.10 per million tokens | First 2 million tokens a month free |
| Security Command Center subscription | Included | 3 billion tokens a month, then $0.10 per million |
Standalone: first 2 million tokens a month free, then $0.10 per million tokens. Security Command Center Enterprise or Premium subscription includes 3 billion tokens a month, then $0.10 per million. Sensitive data checks add no charge.
Is Google Model Armor worth it?
Every AI app that takes text from strangers needs a bouncer at the door: something that spots a customer trying to talk your bot into ignoring its rules, or a reply about to leak a card number. Building that yourself means running and tuning models you would rather not own.
Model Armor is Google's hosted version. Your app sends each prompt and each reply to one API, and it tells you whether anything matched: an injection attempt, harmful content, a dodgy link or sensitive data. You decide per filter how sure it must be before it acts, and whether it just logs or actually blocks.
The price is the headline. At $0.10 per million tokens, about four million characters, screening a million short chat messages costs a few dollars, and the first 2 million tokens each month are free. Sensitive data checks add nothing to the bill. Google says screening happens in memory and content is discarded once the check is done, unless you turn on logging.
The catch: it judges each request alone, with no memory of the conversation, so an attack spread over several turns can pass. It does not decode Base64 or other encodings, which is a common way to sneak instructions past a filter. Injection checks skip inputs under three words, injection and content filters stop at 65,536 tokens and report the excess as skipped rather than flagged, and only the first 256 links in a message are checked. The default quota is 1,200 requests a minute per project, and image screening works only in the US and EU multi-regions.
Our take: Model Armor is the smoke detector of guardrails, cheap enough to fit in every room, but you still want a sprinkler. Pair it with a conversation-aware check, such as an alignment audit on agent steps, if attackers are patient.
Where it earns its place
A product engineer at a 40-person fintech running a support chatbot on Gemini
Stop replies from echoing card numbers and block obvious jailbreaks
Create a template with basic sensitive data checks and prompt injection at medium confidence, start in inspect-only mode with Cloud Logging to review hits, then switch to inspect and block. Typical chat volume stays inside the free 2 million tokens or costs a few dollars.
A platform team exposing several model APIs through Apigee
Apply one screening policy to every team's LLM traffic
Attach Model Armor policies at the Apigee gateway and set floor settings at the project level so no team can ship a template looser than the minimum.
A security lead at a company whose agents use Google's MCP servers
Screen what tools return before the agent acts on it
Turn on the MCP server integration so tool responses pass through Model Armor; budget for the 1,200 requests a minute default quota and request more from Cloud Customer Care if agents run in parallel.
Before you commit
- Setup
- Enable the Model Armor API in a Google Cloud project, create a template with filters and confidence levels, then call the sanitise endpoints for prompts and responses; or switch on an integration such as Apigee or Gemini Enterprise.
- Integrations
- REST API; Google's agent platform and Agent Gateway, Gemini Enterprise, Apigee, Google Cloud networking services, Google and Google Cloud MCP servers, LangChain; Sensitive Data Protection templates for advanced data checks.
- Data and privacy
- Google says processing is stateless and in memory, with content discarded after analysis unless Cloud Logging is on; TLS 1.2 or later in transit; the infrastructure holds SOC 1, 2 and 3 and ISO/IEC 27001 certifications.
- Cost at scale
- $0.10 per million tokens after the free 2 million; skipped data is not charged. A workload screening 1 billion tokens a month pays about $100 standalone, or nothing inside a Security Command Center subscription's 3 billion.
- Limits
- 65,536 tokens per request for injection, content and CSAM filters; 4 MB files; 256 URLs per message; 1,200 requests a minute per project; no audio or video; text and images cannot be mixed in one request.
What’s good
- $0.10 per million tokens with 2 million free each month
- Injection, harmful content, links, sensitive data and CSAM in one call
- Works with models outside Google Cloud
- Floor settings enforce a minimum policy across a project
What’s not
- Checks each request alone, with no conversation memory
- Does not decode Base64 or other encodings
- Oversized inputs are skipped, not flagged
- 1,200 requests a minute per project by default
Best for
Teams on Google Cloud, or any team wanting a low-cost hosted screen for injection, harmful content and data leaks in front of chatbots and agents.
Google Model Armor alternatives
Google Model Armor: common questions
- Is Google Model Armor worth it?
- Model Armor screens prompts and replies for ten cents per million tokens, and its quiet limits, one message at a time and no decoding, are the ones to plan around. We rate it 4.2 out of 5.
- How much does Google Model Armor cost?
- Standalone: first 2 million tokens a month free, then $0.10 per million tokens. Security Command Center Enterprise or Premium subscription includes 3 billion tokens a month, then $0.10 per million. Sensitive data checks add no charge.
- What are the downsides of Google Model Armor?
- Checks each request alone, with no conversation memory; does not decode Base64 or other encodings; oversized inputs are skipped, not flagged; 1,200 requests a minute per project by default.
- Who is Google Model Armor best for?
- Teams on Google Cloud, or any team wanting a low-cost hosted screen for injection, harmful content and data leaks in front of chatbots and agents.
- How much does Google Model Armor cost for a team or in production?
- $0.10 per million tokens after the free 2 million; skipped data is not charged. A workload screening 1 billion tokens a month pays about $100 standalone, or nothing inside a Security Command Center subscription's 3 billion.
- Is Google Model Armor safe for company data?
- Google says processing is stateless and in memory, with content discarded after analysis unless Cloud Logging is on; TLS 1.2 or later in transit; the infrastructure holds SOC 1, 2 and 3 and ISO/IEC 27001 certifications.
- What are the best Google Model Armor alternatives?
- The closest alternatives we have reviewed are Azure AI Content Safety, Lakera Guard (Check Point AI Guardrails) and Google Agent Platform (Vertex AI).
Answers checked Nov 6, 2026.
Make Google Model Armor? Show this rating on your site
