a. Equipment. Google will make the hardware equipment identified in the Google Distributed Cloud Edge (“GDCE”) Order Form available to Customer (“Equipment”) to be hosted in facilities owned, operated by or licensed to the Customer identified in the Order Form (the “Customer Location”). Customer will be liable for any loss of or damage to the Equipment while in Customer’s possession.
b. Installation Support. Google will be responsible for installation of the Equipment at the Customer Location. Google may provide additional installation support on-site or via remote assistance. Each party will provide qualified personnel on-site at the Customer Location as required to assist throughout the Equipment installation process. Customer may not use, install or otherwise access the Equipment prior to installation.
c. Maintenance and Repairs. Google will be responsible for any maintenance or repairs to the Equipment. Customer agrees to provide a named Customer representative on-site during repairs and reasonably cooperate with Google upon request on any maintenance or troubleshooting activities related to the Equipment. Google may repair or replace defective Equipment at its sole discretion. Google engineers have SSH access to the Equipment in order to remotely monitor and maintain the GDCE Services.
d. Onsite Requirements.
i. In the event Google needs to access the Customer Location, Customer will: (a) provide Google authorized personnel with prompt and reasonable access to the extent necessary to perform installation, maintenance, or any other activities requiring Google authorized personnel to access the Customer Location; and (b) follow any written instructions provided by Google during the Equipment installation process.
ii. Google authorized personnel will comply with Customer’s reasonable onsite policies and procedures communicated in writing by Customer prior to the commencement of the Equipment installation process; and (b) provide written instructions to Customer during the installation process detailing any installation procedures and activities for Customer to perform.
iii. These terms supersede and replace any terms, conditions, or agreements (“Onsite Terms”) that Google authorized personnel may be required to accept, sign, or consent to as part of Customer’s standard onsite access procedures and none of those Onsite Terms will apply to Google or Google personnel. Google personnel may include third party subcontractors.
e. Technical Support Services. Google will provide remote technical support services to Customer, which may include (as determined by Google) software updates made available to the Equipment.
f. Customer Location Assessment. Customer is solely responsible for ensuring that the Customer Location is suitable in all respects to support the installation and maintenance of the Equipment in accordance with the GDCE Installation Requirements.
g. Additional Equipment Use Terms. Customer’s use of the Equipment is subject to the following additional terms:
i. Prohibitions. Customer may not: (1) sublicense, loan, sell, rent, or lease the Equipment or any portion thereof; (2) intercept, capture, or modify the contents of any data, other than Customer Data, transmitted between the Equipment and the Google Cloud network; (3) pledge or grant a security interest in the Equipment, or dismantle, export, move, or otherwise re-locate Equipment other than as expressly approved by Google in writing, (4) photograph, video record, capture screenshots, or create an image of the Equipment, in whole or in part, in any format, or (5) perform any action that would introduce to the GDCE Services, the Equipment, or any of their components, any viruses, worms, defects, Trojan horses, malware, or any items of a destructive nature. Customer will not have the capability or right to modify, replace, or interfere with any software installed on the Equipment.
ii. Equipment Ownership. All ownership rights and title in and to the Equipment remain with Google, or its licensors. Customer acknowledges that as between Customer and Google, Customer has no ownership rights in the Equipment or any part of the Equipment and notwithstanding any other term of the Agreement, Google retains exclusive ownership and control of the Equipment.
iii. Third-Party Access. Customer will prohibit any third-party administrator access to the Equipment or the GDCE Services, excluding any contractors engaged directly by Customer or its Affiliates. Subject to the foregoing, Customer may (i) install third-party software and Customer Applications on the Equipment; (ii) allow Customer’s clients and customers to access the Customer Data, third party software and Customer Applications on the Equipment, subject to Customer’s written agreement with such parties; and (iii) provide a product or service that enables multiple Customer Applications, provided that Customer or a third-party partner of Customer isolates one from another. Customer is responsible for any obligations and liabilities related to or arising out of any of the following: (1) third-party software and related data Customer installs on the Equipment, (2) third-party access granted by Customer to such items installed on the Equipment, and (3) any isolation of (or the failure to isolate) multiple Customer Applications or third-party software installed on the Equipment.
h. Amendments to the Agreement. GDCE Services are not deployed at a Google data center and, by design, have characteristics different from the other services offered under the Agreement. As a result, the following terms apply:
i. Inapplicable Provisions. Any Google commitments in the Agreement (including the Cloud Data Processing Addendum (“CDPA”)) or associated security documentation (including whitepapers) that depend on Google’s operation of a Google data center do not apply to GDCE Services.
ii. Other Amendments. Other than this subsection (h), no terms in the Agreement that expressly amend, modify, or supplement the CDPA as then-currently available at https://cloud.google.com/terms/data-processing-addendum or, for partners, at https://cloud.google.com/terms/partners-data-processing-addendum) will apply to GDCE Services.
iii. Audits. GDCE Services are not Audited Services under the CDPA, and are not covered by the Security Documentation or subject to the “Reviews and Audits of Compliance” Section of the CDPA.
iv. CDPA Amendments. The CDPA is amended as follows, solely with respect to GDCE Services:
A. References to “Google’s systems” in the CDPA will be replaced with “the Equipment."
B. Section 6.2 is deleted in its entirety and replaced with the following:
“6.2 Return or Deletion at the end of the Term. Customer instructs Google to delete all remaining Customer Data (including existing copies) from the Equipment at the end of the Term in accordance with applicable law. If Customer wishes to retain any Customer Data after the end of the Term, it may export or make copies of such data prior to the end of the Term. Google will comply with the Instruction in this Section 6.2 as soon as reasonably practicable and within a maximum period of 180 days, unless European Law requires storage.”
C. The following line is added to the end of Section 10.1 (Data Storage and Processing Facilities): “or where the Customer Location is located.”
v. Security Measures. Except as specified in Section 2 (Personnel Security) and Section 3 (Subprocessor Security) of the following Appendix 3, solely with respect to GDCE Services (A) the following Appendix 3 replaces in its entirety the Appendix 2: Security Measures of the Cloud Data Processing Addendum, and (B) any references in the Agreement to “Security Measures” will refer to Appendix 3 below.
Appendix 3: Google Distributed Cloud Edge Security Measures
As from the Terms Effective Date, solely with respect to GDCE Services, Google will implement and maintain the Security Measures described in this Appendix 3.
1. Local Machines and Network Security
Local Machines. Customer Data is solely stored on the Equipment to be deployed in a Customer Location.
Server Operating Systems. Google servers use a Linux based implementation customized for the application environment. Google employs a code review process to increase the security of the code used to provide the GDCE Services and enhance the security products in GDCE production environments.
Encryption Technologies. Google makes HTTPS encryption (also referred to as SSL or TLS connection) available and allows for encryption of data in transit. Google servers support ephemeral elliptic curve Diffie-Hellman cryptographic key exchange signed with RSA and ECDSA. These perfect forward secrecy (PFS) methods help protect traffic and minimize the impact of a compromised key, or a cryptographic breakthrough. Google also makes encryption of data at rest available, using at least AES128 or similar. GDCE Services have a CMEK integration; more information can be found here: https://cloud.google.com/kms/docs/cmek.
Connection to Cloud VPN. Google allows Customer to enable and configure a strong, encrypted interconnection between the Equipment and Customer's Virtual Private Cloud using Cloud VPN through an IPSEC VPN connection.
Bound Storage. Customer's data storage is bound to the server. Should a disk be stolen or copied at rest, the contents of such disk will be unrecoverable outside of the server.
2. Personnel Security
Section 4 of Appendix 2 (Security Measures) continues to apply.
3. Subprocessor Security
Section 5 of Appendix 2 (Security Measures) continues to apply.
i. Customer Obligations. Without limiting Google's express obligations related to GDCE Services, Customer will take reasonable steps to protect and maintain the security of Customer Data and any other content stored on or processed through GDCE Services.
j. Cooperation. Customer will provide reasonable and timely cooperation in connection with Google’s provision of the GDCE Services (including compliance with the GDCE Installation Requirements). Google will not be liable for a delay caused by Customer’s failure to provide Google with information, consents, or access to Customer facilities, networks, or systems required for Google to provide the GDCE Services. Customer will provide access to the Equipment in order to comply with any Legal Process, in accordance with the requirements in the Confidentiality section of the Agreement.
k. Disclaimer. Google and its subcontractors are not responsible for any of the following in relation to GDCE Services: (i) data backup, including any redundancy or high-availability configuration; or (ii) business continuity and disaster recovery policies or procedures.
l. Return of Equipment. Upon termination or expiration of the Term, Customer will: (i) immediately stop using the Equipment; and (ii) cooperate with Google (or Google’s designated subcontractor) in any necessary wind-down activities, including making a named Customer representative available at Customer Location and, if applicable, making the Equipment available in its original condition (reasonable wear and tear excepted) for Google’s designated courier to collect within thirty (30) days of the effective date of termination or expiration (“Return Date”). If Customer fails to abide by the preceding sentence, Google will have the right to: (A) charge Customer and Customer will pay the fair market value of the Equipment; or (B) recover and take possession of such Equipment, and for this purpose may, upon at least 30 days’ written notice, enter the Customer Location during normal working hours to remove the Equipment.
m. Survival. The following subsections of these GDCE Service Specific Terms will survive expiration or termination of the Agreement: (k) Disclaimer; (l) Return of Equipment, (m) Survival; and (q) Definitions.
n. Ordering. Except for GDCE proofs of concept and trials, Customer must order GDCE Services via an order form mutually executed by Customer and Google.
o. GDCE Proof of Concepts. GDCE proof of concepts and trials are “Pre-GA Offerings” subject to the Pre-GA Offerings Terms in the General Services Terms of these Service Specific Terms and may not be used in connection with production workloads.
p. Marketplace Software. Customer may purchase and deploy optional software from Google Cloud Marketplace (“Marketplace Software”), which will be subject to the pricing, terms and conditions presented at the time of purchase, which includes the Google Cloud Marketplace Terms of Service. In addition, Customer’s use of Marketplace Software will be subject to any additional terms and conditions established between Customer and the Marketplace Software vendor. Any software updates to Marketplace Software may be integrated into and managed as part of the regular GDCE software update process. GDCE availability and support do not apply to Marketplace Software availability.
q. Definitions.
“GDCE Services” means the Services described under the “Google Distributed Cloud Edge” section at https://cloud.google.com/terms/services.
“GDCE Installation Requirements” means the terms set forth at: https://cloud.google.com/distributed-cloud-edge/docs/requirements.
“Google” as used in this section also includes Google Affiliates.
