Google Cloud compliance, certifications and attestations

An auditor's report on controls relevant to customers' financial reporting.

HeldVendor page

An auditor's report on security, availability, confidentiality, processing integrity and privacy controls.

HeldVendor page

A public summary of a SOC 2 examination, readable without an NDA.

HeldVendor page

A certified information security management system.

HeldVendor page

Cloud-specific security controls on top of ISO 27001.

HeldVendor page

Protection of personal data in public clouds acting as processors.

HeldVendor page

A certified privacy information management system extending ISO 27001.

HeldVendor page

A certified quality management system.

HeldVendor page

A certified business continuity management system.

HeldVendor page

A certified IT service management system.

HeldVendor page

A certified AI management system: how a company governs the AI it builds or uses.

HeldVendor page

Authorization to sell a cloud service to US federal agencies.

HighFedRAMP MarketplaceGemini for Government (FedRAMP 20x); Google Workspace

A security verification for US state and local government cloud buyers.

HighGovRAMP product listGoogle Services (Authorized, Federal JAB, High); Google Workspace (Authorized, Federal JAB, High)

Cryptographic modules validated under FIPS 140-2 or 140-3.

FIPS 140-3NIST CMVP20 active FIPS 140-3 modules: #5565 Inline Crypto Engine (ICE); #5558 Integrated Compute Complex (ICC); #5550 Integrated Compute Complex (ICC); #5539 B227 True Random Number Generator (TRNG) Cryptographic Module; #5537 Google Tensor 6th Gen UFS Inline Storage Encryption Engine; #5474 Knuckle Cryptog

Validated compliance with the card industry data security standard.

HeldVendor page

Support for APRA prudential standards on information security.

HeldVendor page

The vendor supports HIPAA-regulated health data and signs a Business Associate Agreement.

HeldVendor page

A certified assessment against the HITRUST CSF.

HeldVendor page

Support for regulated life-sciences workloads under GMP, GCP and GLP.

HeldVendor page

Support for electronic records and signatures under 21 CFR Part 11.

HeldVendor page

Support for computerised systems under EU GMP Annex 11.

HeldVendor page

Computer system validation or computer software assurance packages for customers.

HeldVendor page

Self-certification under the EU-US Data Privacy Framework, with UK and Swiss extensions where noted.

HeldData Privacy Framework ListEU-US, UK extension, Swiss-US; non-HR data and HR data. Covered entity of Google LLC

Adherence to the GDPR code of conduct for cloud processors.

HeldCSA STAR RegistryPartner entry in the STAR Registry

A listing in the Cloud Security Alliance STAR Registry.

Level 2CSA STAR RegistryCAIQ, certification, attestation

An attestation against Germany's Cloud Computing Compliance Criteria Catalogue.

HeldVendor page

Certification under Spain's Esquema Nacional de Seguridad.

HeldVendor page

An assessment by an ASD-endorsed assessor for Australian government data.

HeldVendor page

Registration on Japan's government cloud security list.

HeldVendor page

Certification under Singapore's Multi-Tier Cloud Security standard.

HeldVendor page

An assessment shared through the German automotive industry's exchange.

HeldVendor page