Certificate Certificate number: 2016-004b Certified by EY CertifyPoint since: April 15, 2016 Based on certification examination in conformity with defined requirements in ISO/IEC 17021-1:2015 and ISO/IEC 27006:2015, the Information Security Management System as defined and implemented by Google LLC* located in Mountain View, California, United States of is compliant with the requirements as stated in the standard: ISO/IEC 27017:2015 Issue date of certificate: April 15, 2016 Re-issue date of certificate: October 31, 2017 Expiration date of certificate: April 14, 2018 EY CertifyPoint will, according to the certification agreement dated February 13, 2015, perform surveillance audits and acknowledge the certificate until the expiration date noted above. *The certification is applicable for the assets, services and locations as described in the scoping section on the back of this certificate, with regard to the specific requirements for information security as stated in the Statement of Applicability, version 3.1, dated August 18, 2017. Drs. J. Sehgal RE Director, EY CertifyPoint Copyrights with regard to this document reside with Ernst & Young CertifyPoint B.V., headquartered at Antonio Vivaldistraat 150, 1083 HP Amsterdam, the Netherlands. All rights reserved. Page 1 of 5
The scope of this ISO/IEC 27017:2015 certification is bounded by the following products and their offerings as listed below, along with the data contained or collected by those offerings: Google Cloud Platform App Engine App Engine Flexible Environment BigQuery Cloud Bigtable Cloud Billing API Cloud CDN (Content Delivery Network) Cloud Console Cloud Data Loss Prevention API Cloud Dataflow Cloud SDK Cloud Security Scanner Cloud Shell Cloud Source Repositories Cloud Spanner Cloud Speech API Cloud SQL Cloud Storage Cloud Translation API Cloud Datalab Cloud Video Intelligence API Cloud Dataproc Cloud Virtual Network Cloud Datastore Cloud Vision API Cloud DNS (Domain Name System) Cloud VPN Cloud Endpoints Compute Engine Cloud Functions Container Builder Cloud IAM (Identity & Access Container Engine Management) Cloud Identity-Aware Proxy Container Registry Cloud IoT Core Debugger Cloud Jobs API Deployment Manager Cloud Key Management Service Cloud Launcher Cloud Load Balancing Cloud Machine Learning Engine Cloud Mobile App Cloud Natural Language API Cloud Pub/Sub Cloud Resource Manager Cloud Router Error Reporting Genomics Google Service Control Stackdriver Logging Trace Page 2 of 5
The following locations are in scope: Data Centers: Atlanta (1) (GA), United States of Atlanta (2) (GA), United States of Changhua, Taiwan Council Bluffs (1) (IA), United States of Council Bluffs (2) (IA), United States of The Dalles (OR), United States of Dublin, Ireland Eemshaven, Groningen, Netherlands Ghlin, Hainaut, Belgium Hamina, Finland Lenoir (NC), United States of Longtan, Taoyuan, Taiwan Moncks Corner (SC), United States of Pryor Creek (OK), United States of Quilicura, Santiago, Chile Wenya, Singapore Koto-ku, Tokyo, Japan Ashburn (VA), United States of London, United Kingdom Frankfurt, Hesse, Germany Sydney, Australia Offices (continued): Offices: Mountain View (CA), United States of Sunnyvale (CA), United States of San Francisco (CA), United States Irvine (CA), United States of Boulder (CO), United States of Cambridge (MA), United States of New York (NY), United States of Kirkland (WA), United States of Seattle (WA), United States of Sydney, Australia Belo Horizonte, Brazil Hyderabad, India Bangalore, India Dublin, Ireland Tokyo, Japan Krakow, Poland Los Angeles (CA), United States of Shanghai, China Manila, Philippines Gurgaon, India San Bruno (CA), United States of Madison (WI), United States of Aarhus, Denmark Singapore, Singapore Tel Aviv, Israël Page 3 of 5
Pittsburgh (PA), United States of Kitchener, Canada Munich, Germany Palo Alto (CA), United States of Chicago (IL), United States of Beijing, China Paris, France Warsaw, Poland Stockholm, Sweden Austin (TX), United States of Rennes, France Kampala, Uganda Austell (GA), United States of Berlin, Germany Haifa, Israël Montreal, Canada Mumbai, India Prague, Czech Republic St. Louis Park (MN), United States of Melbourne, Australia Zurich, Switzerland London, United Kingdom Malaga, Spain Buenos Aires, Brazil Milan, Italy Dubai, United Arab Emirates Moscow, Russia The Dalles (OR), United States of Amsterdam, Netherland Council Bluffs (IA), United States of Madrid, Spain Offices (continued): Louisville (KY), United States of Surprise (AZ), United States of Kuala Lumpur, Malaysia Accra, Ghana Moncks Corner (SC), United States of Waltham (MA), United States of Copenhagen, Denmark Addison (TX), United States of Helsinki, Finland Lagos, Nigerian Pryor Creek (OK), United States of Birmingham, United Kingdom Brussels, Brussels Beverly Hills (CA), United States of Bangkok Thailand Taipei, Taiwan Seoul, South Korea Wroclaw, Poland Ann Arbor (MI), United States of San Diego (CA), United States of Atlanta (GA), United States of Portland (OR), United States of Sao Paulo, Brazil Thornton (CO), United States of Chapel Hill (NC), United States of Hamburg, Germany (Continued on next page) Page 4 of 5
Lenoir (NC), United States of Edmonton, Canada Toronto, Canada Istanbul, Turkey San Jose (CA), United States of Reston (VA), United States of Durham (NC), United States of Goleta (CA), United States of Playa Vista (CA), United States of Washington DC, United States of Bothell (WA), United States of Hong Kong, Hong Kong Nairobi, Kenya Mexico City, Mexico Miami (FL), United States of San Antonio (TX), United States of The Information Security Management System (ISMS) is centrally managed out of the Google LLC headquarters in Mountain View, California, United States of. The ISMS mentioned in the above scope is restricted as defined in the Information Security Management System (ISMS) Implementation Manual, version 3.4, signed on October 26, 2017, by the Director, Engineering Compliance. Page 5 of 5