Compliance Reports Manager
Google Cloud’s industry-leading security, third-party audits and certifications, documentation, and contract commitments help support your compliance. Compliance reports manager provides you with easy, on-demand access to these critical compliance resources, at no additional cost. Key resources include our latest ISO/IEC certificates, SOC reports, and self assessments.
Select resources may require sign-in with your Google Cloud or Google Workspace account. If you would like to access previous reports please reach out to support for more information. Anything marked "Google Confidential Information" is shared subject to the confidentiality obligations described in the customer or partner agreement(s) covering Cloud Services. Please contact your sales representative for permission to share confidential resources outside of your organization with customers or other third parties not expressly permitted by your agreement.
- Industry-agnostic
- Media and entertainment
- Financial services
- Government and public sector
- EMEA
- Global
- APAC
- Statement of Applicability
- Certificate
- Vendor Risk Assessment
- Bridge Letter
- Audit Report
- Google Workspace
- Apigee Edge
- Bare Metal Solution
- AppSheet
- Looker
- Google Cloud
- Google Maps Platform
- Google Distributed Cloud
Compliance | Report type | Product area | Last audit |
---|---|---|---|
C5:2020 The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers. | Audit Report | Google Workspace | Feb 4, 2025 |
C5:2020 The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers. | Audit Report | Google Cloud | Feb 4, 2025 |
C5:2020 The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers. | Audit Report | Apigee Edge | May 22, 2023 |
C5:2020 The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers. | Audit Report | Looker | Jun 29, 2024 |
C5:2020 The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers. | Audit Report | Bare Metal Solution | Mar 27, 2024 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider through a three-step program of self-assessment, third-party audit, and continuous monitoring. | Audit Report | Google Workspace | Apr 30, 2024 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider through a three-step program of self-assessment, third-party audit, and continuous monitoring. | Audit Report | Google Cloud | Apr 30, 2024 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix. | Vendor Risk Assessment | Google Cloud | May 31, 2023 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix. | Vendor Risk Assessment | Google Workspace | May 31, 2023 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix. | Vendor Risk Assessment | Google Maps Platform | Nov 29, 2023 |
CSA STAR The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix. | Certificate | Google Cloud | May 13, 2024 |
ENS (National Security Framework) Spain The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. | Audit Report | Google Workspace | Oct 13, 2019 |
ENS (National Security Framework) Spain The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. | Certificate | Google Workspace | Oct 17, 2023 |
ENS (National Security Framework) Spain The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. Google Cloud has met the requirements to comply with ENS at the "High" level. | Audit Report | Google Cloud | Oct 13, 2019 |
ENS (National Security Framework) Spain The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. Google Cloud has met the requirements to comply with ENS at the "High" level. | Certificate | Google Cloud | Oct 17, 2023 |
GNS - Portugal The National Security Authority Office of Portugal (GNS) is the accreditation authority for national and international organizations accessing or handling classified information in Portugal. | Certificate | Google Cloud | Oct 25, 2023 |
GNS - Portugal The National Security Authority Office of Portugal (GNS) is the accreditation authority for national and international organizations accessing or handling classified information in Portugal. | Certificate | Google Workspace | Oct 25, 2023 |
IRAP Protected IRAP—the Information Security Registered Assessors Program—provides a framework for assessing the implementation and effectiveness of an organization’s security controls against the Australian government’s security requirements. | Audit Report | Google Cloud | Jan 30, 2024 |
IRAP Protected IRAP—the Information Security Registered Assessors Program—provides a framework for assessing the implementation and effectiveness of an organization’s security controls against the Australian government’s security requirements. | Audit Report | Google Workspace | Jan 30, 2024 |
ISO 9001 ISO 9001 is the global standard, which companies implement to help ensure the quality of products brought to market. | Certificate | Looker | Jun 29, 2024 |
ISO 9001 ISO 9001 is the global standard, which companies implement to help ensure the quality of products brought to market. | Certificate | Google Maps Platform | Jun 4, 2024 |
ISO/IEC 27001:2013 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Apigee Edge | Apr 30, 2023 |
ISO/IEC 27001:2013 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Looker | Jun 29, 2024 |
ISO/IEC 27001:2013 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Bare Metal Solution | Mar 27, 2024 |
ISO/IEC 27001:2022 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Google Cloud | Nov 26, 2024 |
ISO/IEC 27001:2022 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Statement of Applicability | Google Cloud | Jan 9, 2025 |
ISO/IEC 27001:2022 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Google Workspace | Nov 26, 2024 |
ISO/IEC 27001:2022 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Statement of Applicability | Google Workspace | Jan 9, 2025 |
ISO/IEC 27001:2022 ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks. | Certificate | Google Maps Platform | Nov 26, 2024 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Google Workspace | Nov 26, 2024 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Google Cloud | Nov 26, 2024 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Apigee Edge | Apr 30, 2023 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Statement of Applicability | Google Cloud | Jan 9, 2025 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Statement of Applicability | Google Workspace | Jan 9, 2025 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Looker | Jun 29, 2024 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Bare Metal Solution | Mar 27, 2024 |
ISO/IEC 27017:2015 ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services. | Certificate | Google Maps Platform | May 9, 2024 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Certificate | Google Workspace | Nov 26, 2024 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Certificate | Google Cloud | Nov 26, 2024 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Certificate | Apigee Edge | Apr 30, 2023 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Statement of Applicability | Google Cloud | Jan 9, 2025 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Statement of Applicability | Google Workspace | Jan 9, 2025 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Certificate | Looker | Jun 29, 2024 |
ISO/IEC 27018:2019 ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII). | Certificate | Bare Metal Solution | Mar 27, 2024 |
ISO/IEC 27701:2019 Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management | Statement of Applicability | Google Cloud | Jan 9, 2025 |
ISO/IEC 27701:2019 Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management | Statement of Applicability | Google Workspace | Jan 9, 2025 |
ISO/IEC 27701:2019 Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management | Certificate | Looker | Jun 29, 2024 |
ISO/IEC 27701:2019 ISO/IEC 27701 is the first global privacy standard that focuses on the collection and processing of personally identifiable information (PII). This standard was developed to help organizations comply with international privacy frameworks and laws. | Certificate | Google Cloud | Nov 26, 2024 |
ISO/IEC 27701:2019 ISO/IEC 27701 is the first global privacy standard that focuses on the collection and processing of personally identifiable information (PII). This standard was developed to help organizations comply with international privacy frameworks and laws. | Certificate | Google Workspace | Nov 26, 2024 |
Multi-tiered Cloud Computing Security Management System (MTCS) The Multi-Tier Cloud Security (MTCS) Singapore Standard (SS)584 is a cloud security certification managed by the Singapore Info-comm Media Development Authority (IMDA). | Certificate | Google Cloud | Apr 30, 2024 |
Multi-tiered Cloud Computing Security Management System (MTCS) The Multi-Tier Cloud Security (MTCS) Singapore Standard (SS)584 is a cloud security certification managed by the Singapore Info-comm Media Development Authority (IMDA). | Certificate | Google Workspace | Apr 30, 2024 |
OSPAR The Association of Banks in Singapore established the Guidelines on Control Objectives and Procedures for Outsourced Service Providers which provide information security guidelines for Outsourced Service Providers who wish to provide services to Financial Institutions operating in Singapore. | Audit Report | Google Cloud | Apr 30, 2024 |
OSPAR The Association of Banks in Singapore established the Guidelines on Control Objectives and Procedures for Outsourced Service Providers which provide information security guidelines for Outsourced Service Providers who wish to provide services to Financial Institutions operating in Singapore. | Audit Report | Google Workspace | Apr 30, 2024 |
PCI 3-D Secure (PCI 3DS) v1.0 PCI 3-D Secure is a security protocol that adds an extra layer of protection to online payments. Google Cloud has undergone a third-party audit to attest to compliance with the PCI 3DS Core Security Standard. | Audit Report | Google Cloud | Jun 25, 2024 |
PCI-DSS v3.2 PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS. | Audit Report | Apigee Edge | Jun 14, 2023 |
PCI-DSS v3.2 PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS. | Audit Report | Bare Metal Solution | Mar 27, 2024 |
PCI-DSS v4.0 The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance payment card account data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect account data. While specifically designed to focus on environments with payment card account data, PCI DSS can also be used to protect against threats and secure other elements in the payment ecosystem. | Certificate | Looker | Jun 29, 2024 |
PCI-DSS v4.0 PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS. | Audit Report | Google Cloud | Dec 15, 2024 |
PCI-DSS v4.0 PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS. | Audit Report | Google Distributed Cloud | Dec 17, 2024 |
SSAE18 - SOC 1 (Service Organization Controls Report) A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements. | Audit Report | Google Workspace | Dec 18, 2024 |
SSAE18 - SOC 1 (Service Organization Controls Report) A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements. | Audit Report | Google Cloud | Dec 18, 2024 |
SSAE18 - SOC 1 (Service Organization Controls Report) A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements. | Audit Report | Apigee Edge | May 22, 2023 |
SSAE18 - SOC 1 (Service Organization Controls Report) A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements. | Audit Report | Looker | Jun 29, 2024 |
SSAE18 - SOC 1 (Service Organization Controls Report) A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements. | Audit Report | Bare Metal Solution | Mar 27, 2024 |
SSAE18 - SOC 1 (Service Organization Controls Report) Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. | Bridge Letter | Google Cloud | Jan 1, 2025 |
SSAE18 - SOC 1 (Service Organization Controls Report) Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. | Bridge Letter | Google Workspace | Jan 1, 2025 |
SSAE18 - SOC 2 AICPA Trust Service Criteria Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. | Bridge Letter | Google Cloud | Jan 1, 2025 |
SSAE18 - SOC 2 AICPA Trust Service Criteria Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. | Bridge Letter | Google Workspace | Jan 1, 2025 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Google Workspace | Dec 18, 2024 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Google Cloud | Dec 18, 2024 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Apigee Edge | May 22, 2023 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | AppSheet | Jul 10, 2023 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Looker | Jun 29, 2024 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Google Maps Platform | Jan 6, 2025 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Bare Metal Solution | Mar 27, 2024 |
SSAE18 - SOC 2 AICPA Trust Service Criteria The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy. | Audit Report | Google Distributed Cloud | Jan 13, 2025 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Google Cloud | Dec 18, 2024 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Google Workspace | Dec 18, 2024 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Apigee Edge | May 22, 2023 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Google Maps Platform | Jan 6, 2025 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Looker | Jun 29, 2024 |
SSAE18 - SOC 3 AICPA Trust Service Criteria The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality. | Audit Report | Bare Metal Solution | Mar 27, 2024 |
Failed to download selected reports
Download failed due to system error. Please try again or reach out to support for more information.