Compliance Reports Manager

Google Cloud’s industry-leading security, third-party audits and certifications, documentation, and contract commitments help support your compliance. Compliance reports manager provides you with easy, on-demand access to these critical compliance resources, at no additional cost. Key resources include our latest ISO/IEC certificates, SOC reports, and self assessments.

Select resources may require sign-in with your Google Cloud or Google Workspace account. If you would like to access previous reports please reach out to support for more information. Anything marked "Google Confidential Information" is shared subject to the confidentiality obligations described in the customer or partner agreement(s) covering Cloud Services. Please contact your sales representative for permission to share confidential resources outside of your organization with customers or other third parties not expressly permitted by your agreement.

Filter By:
  • Industry-agnostic
  • Media and entertainment
  • Financial services
  • Government and public sector
  • EMEA
  • Global
  • APAC
  • Statement of Applicability
  • Certificate
  • Vendor Risk Assessment
  • Bridge Letter
  • Audit Report
  • Google Workspace
  • Apigee Edge
  • Bare Metal Solution
  • AppSheet
  • Looker
  • Google Cloud
  • Google Maps Platform
  • Google Distributed Cloud

Public compliance reports are available to download.
Sign in with your Google Cloud or Google Workspace account to download additional reports.

ComplianceReport typeProduct areaLast audit
C5:2020

The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers.

Audit ReportGoogle WorkspaceFeb 4, 2025
C5:2020

The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers.

Audit ReportGoogle CloudFeb 4, 2025
C5:2020

The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers.

Audit ReportApigee EdgeMay 22, 2023
C5:2020

The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers.

Audit ReportLookerJun 29, 2024
C5:2020

The Cloud Computing Compliance Controls Catalogue (C5), developed by the German government, assesses the information security of cloud services that leverage internationally recognized security standards such as ISO/IEC 27001 to establish a framework of trust between cloud providers and their customers.

Audit ReportBare Metal SolutionMar 27, 2024
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider through a three-step program of self-assessment, third-party audit, and continuous monitoring.

Audit ReportGoogle WorkspaceApr 30, 2024
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider through a three-step program of self-assessment, third-party audit, and continuous monitoring.

Audit ReportGoogle CloudApr 30, 2024
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix.

Vendor Risk AssessmentGoogle Cloud May 31, 2023
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix.

Vendor Risk AssessmentGoogle Workspace May 31, 2023
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix.

Vendor Risk AssessmentGoogle Maps Platform Nov 29, 2023
CSA STAR

The CSA’s Security, Trust and Assurance Registry Program (CSA STAR) is designed to help customers assess and select a cloud service provider. This CSA STAR Level 1 - Customer Assessment Initiative Questionnaire (CAIQ) is a self-assessment that evaluates a cloud provider against CSA's Cloud Control Matrix.

CertificateGoogle Cloud May 13, 2024
ENS (National Security Framework) Spain

The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities.

Audit ReportGoogle WorkspaceOct 13, 2019
ENS (National Security Framework) Spain

The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities.

CertificateGoogle Workspace Oct 17, 2023
ENS (National Security Framework) Spain

The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. Google Cloud has met the requirements to comply with ENS at the "High" level.

Audit ReportGoogle CloudOct 13, 2019
ENS (National Security Framework) Spain

The ENS was established as part of Royal Decree 3/2010 (amended by Decree 951/2015) and serves to establish principles and requirements for the adequate protection of information for Spanish public sector entities. Google Cloud has met the requirements to comply with ENS at the "High" level.

CertificateGoogle Cloud Oct 17, 2023
GNS - Portugal

The National Security Authority Office of Portugal (GNS) is the accreditation authority for national and international organizations accessing or handling classified information in Portugal.

CertificateGoogle Cloud Oct 25, 2023
GNS - Portugal

The National Security Authority Office of Portugal (GNS) is the accreditation authority for national and international organizations accessing or handling classified information in Portugal.

CertificateGoogle Workspace Oct 25, 2023
IRAP Protected

IRAP—the Information Security Registered Assessors Program—provides a framework for assessing the implementation and effectiveness of an organization’s security controls against the Australian government’s security requirements.

Audit ReportGoogle CloudJan 30, 2024
IRAP Protected

IRAP—the Information Security Registered Assessors Program—provides a framework for assessing the implementation and effectiveness of an organization’s security controls against the Australian government’s security requirements.

Audit ReportGoogle WorkspaceJan 30, 2024
ISO 9001

ISO 9001 is the global standard, which companies implement to help ensure the quality of products brought to market.

CertificateLooker Jun 29, 2024
ISO 9001

ISO 9001 is the global standard, which companies implement to help ensure the quality of products brought to market.

CertificateGoogle Maps Platform Jun 4, 2024
ISO/IEC 27001:2013

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateApigee Edge Apr 30, 2023
ISO/IEC 27001:2013

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateLooker Jun 29, 2024
ISO/IEC 27001:2013

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateBare Metal Solution Mar 27, 2024
ISO/IEC 27001:2022

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateGoogle Cloud Nov 26, 2024
ISO/IEC 27001:2022

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

Statement of ApplicabilityGoogle CloudJan 9, 2025
ISO/IEC 27001:2022

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateGoogle Workspace Nov 26, 2024
ISO/IEC 27001:2022

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

Statement of ApplicabilityGoogle WorkspaceJan 9, 2025
ISO/IEC 27001:2022

ISO/IEC 27001 provides the requirements for an information security management system (ISMS), specifies a set of best practices, and details the security controls that can help manage information risks.

CertificateGoogle Maps Platform Nov 26, 2024
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateGoogle Workspace Nov 26, 2024
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateGoogle Cloud Nov 26, 2024
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateApigee Edge Apr 30, 2023
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

Statement of ApplicabilityGoogle CloudJan 9, 2025
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

Statement of ApplicabilityGoogle WorkspaceJan 9, 2025
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateLooker Jun 29, 2024
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateBare Metal Solution Mar 27, 2024
ISO/IEC 27017:2015

ISO/IEC 27017:2015 provides guidelines for information security controls applicable to the provision and use of cloud services.

CertificateGoogle Maps Platform May 9, 2024
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

CertificateGoogle Workspace Nov 26, 2024
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

CertificateGoogle Cloud Nov 26, 2024
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

CertificateApigee Edge Apr 30, 2023
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

Statement of ApplicabilityGoogle CloudJan 9, 2025
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

Statement of ApplicabilityGoogle WorkspaceJan 9, 2025
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

CertificateLooker Jun 29, 2024
ISO/IEC 27018:2019

ISO/IEC 27018 focuses on privacy and security controls for public-cloud service providers that process personally identifiable information (PII).

CertificateBare Metal Solution Mar 27, 2024
ISO/IEC 27701:2019

Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management

Statement of ApplicabilityGoogle CloudJan 9, 2025
ISO/IEC 27701:2019

Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management

Statement of ApplicabilityGoogle WorkspaceJan 9, 2025
ISO/IEC 27701:2019

Information technology -- Security techniques Enhancement to [ISO/IEC](http://ISO/IEC) 27001 for privacy management

CertificateLooker Jun 29, 2024
ISO/IEC 27701:2019

ISO/IEC 27701 is the first global privacy standard that focuses on the collection and processing of personally identifiable information (PII). This standard was developed to help organizations comply with international privacy frameworks and laws.

CertificateGoogle Cloud Nov 26, 2024
ISO/IEC 27701:2019

ISO/IEC 27701 is the first global privacy standard that focuses on the collection and processing of personally identifiable information (PII). This standard was developed to help organizations comply with international privacy frameworks and laws.

CertificateGoogle Workspace Nov 26, 2024
Multi-tiered Cloud Computing Security Management System (MTCS)

The Multi-Tier Cloud Security (MTCS) Singapore Standard (SS)584 is a cloud security certification managed by the Singapore Info-comm Media Development Authority (IMDA).

CertificateGoogle Cloud Apr 30, 2024
Multi-tiered Cloud Computing Security Management System (MTCS)

The Multi-Tier Cloud Security (MTCS) Singapore Standard (SS)584 is a cloud security certification managed by the Singapore Info-comm Media Development Authority (IMDA).

CertificateGoogle Workspace Apr 30, 2024
OSPAR

The Association of Banks in Singapore established the Guidelines on Control Objectives and Procedures for Outsourced Service Providers which provide information security guidelines for Outsourced Service Providers who wish to provide services to Financial Institutions operating in Singapore.

Audit ReportGoogle CloudApr 30, 2024
OSPAR

The Association of Banks in Singapore established the Guidelines on Control Objectives and Procedures for Outsourced Service Providers which provide information security guidelines for Outsourced Service Providers who wish to provide services to Financial Institutions operating in Singapore.

Audit ReportGoogle WorkspaceApr 30, 2024
PCI 3-D Secure (PCI 3DS) v1.0

PCI 3-D Secure is a security protocol that adds an extra layer of protection to online payments. Google Cloud has undergone a third-party audit to attest to compliance with the PCI 3DS Core Security Standard.

Audit ReportGoogle CloudJun 25, 2024
PCI-DSS v3.2

PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS.

Audit ReportApigee EdgeJun 14, 2023
PCI-DSS v3.2

PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS.

Audit ReportBare Metal SolutionMar 27, 2024
PCI-DSS v4.0

The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance payment card account data security and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirements designed to protect account data. While specifically designed to focus on environments with payment card account data, PCI DSS can also be used to protect against threats and secure other elements in the payment ecosystem.

CertificateLooker Jun 29, 2024
PCI-DSS v4.0

PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS.

Audit ReportGoogle CloudDec 15, 2024
PCI-DSS v4.0

PCI DSS is a set of network security and business best practices guidelines adopted by the PCI Security Standards Council to establish a “minimum security standard” to protect customers’ payment card information. The Attestation of Compliance provides formal assurance from a Qualified Security Assessor (QSA) as to adherence to the PCI DSS.

Audit ReportGoogle Distributed CloudDec 17, 2024
SSAE18 - SOC 1 (Service Organization Controls Report)

A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements.

Audit ReportGoogle WorkspaceDec 18, 2024
SSAE18 - SOC 1 (Service Organization Controls Report)

A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements.

Audit ReportGoogle CloudDec 18, 2024
SSAE18 - SOC 1 (Service Organization Controls Report)

A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements.

Audit ReportApigee EdgeMay 22, 2023
SSAE18 - SOC 1 (Service Organization Controls Report)

A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements.

Audit ReportLookerJun 29, 2024
SSAE18 - SOC 1 (Service Organization Controls Report)

A SOC 1 report documents a cloud service provider’s internal controls that may be relevant to a customer’s financial reporting. This report is particularly useful for organizations that audit financial statements.

Audit ReportBare Metal SolutionMar 27, 2024
SSAE18 - SOC 1 (Service Organization Controls Report)

Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report.

Bridge LetterGoogle CloudJan 1, 2025
SSAE18 - SOC 1 (Service Organization Controls Report)

Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report.

Bridge LetterGoogle WorkspaceJan 1, 2025
SSAE18 - SOC 2 AICPA Trust Service Criteria

Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report.

Bridge LetterGoogle CloudJan 1, 2025
SSAE18 - SOC 2 AICPA Trust Service Criteria

Bridge letters are attestations made by management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report.

Bridge LetterGoogle WorkspaceJan 1, 2025
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportGoogle WorkspaceDec 18, 2024
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportGoogle CloudDec 18, 2024
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportApigee EdgeMay 22, 2023
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportAppSheetJul 10, 2023
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportLookerJun 29, 2024
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportGoogle Maps PlatformJan 6, 2025
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportBare Metal SolutionMar 27, 2024
SSAE18 - SOC 2 AICPA Trust Service Criteria

The purpose of the SOC 2 report is to evaluate an organization’s information systems relevant to security, availability, processing integrity, confidentiality, and privacy.

Audit ReportGoogle Distributed CloudJan 13, 2025
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportGoogle Cloud Dec 18, 2024
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportGoogle Workspace Dec 18, 2024
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportApigee Edge May 22, 2023
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportGoogle Maps Platform Jan 6, 2025
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportLooker Jun 29, 2024
SSAE18 - SOC 3 AICPA Trust Service Criteria

The SOC 3 report has been developed based on the Auditing Standards Board of the American Institute of Certified Public Accountants’ (AICPA) Trust Service Criteria (TSC). The SOC 3 is a public report of internal controls over security, availability, processing integrity, and confidentiality.

Audit ReportBare Metal Solution Mar 27, 2024

Failed to download selected reports

Download failed due to system error. Please try again or reach out to support for more information.