SOC 1

Google Cloud regularly undergoes third-party audits for our products, systems, and infrastructure related to this standard. The SOC 1 reports are generated by an objective third party attesting to a set of assertions made by Google Cloud about its controls. The audit firm’s evaluation includes comprehensive testing of the design and operating effectiveness of the controls within the audit period. 

Customers may use the SOC 1 report to assess the risks arising from interactions with the assessed Google Cloud and Google Workspace services throughout the period.

The core Google Cloud and Google Workspace SOC 1 Type II reports are issued quarterly and can be downloaded via the Compliance Reports Manager. The coverage periods and issuance dates for these reports are:

• First quarter of the year 
• Coverage period: February 1 XX - January 31 X1
• Estimated issuance: late April
• Second quarter of the year
• Coverage period: May 1 XX - April 30 X1
• Estimated issuance: late June
• Third quarter of the year
• Coverage period: August 1 XX - July 31 X1
• Estimated issuance: late September
• Fourth quarter of the year
• Coverage period: November 1 XX - October 31 X1
• Estimated issuance: late December

We issue separate SOC 1 Type II reports for a small subset of Google Cloud products, including Bare Metal Solution, BigQuery Omni, Google Cloud NetApp Volumes, and Google Cloud VMware Engine. These reports are issued semi-annually or annually and customers can obtain them by contacting sales or support.

Bridge letters are attestations made by the management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. Bridge letters are available for SOC 1 and SOC 2 reports.

Google Cloud creates monthly bridge letters with each letter designed to cover the period since the most recent SOC report. For example, Google Cloud issues a bridge letter in early January to cover the look-back period of November 1 to December 31, which extends the coverage period of the previously issued SOC report with a period end date of October 31.

SOC bridge letters for the core Google Cloud and Google Workspace SOC 1 reports are available on Compliance Reports Manager for the periods ending March 31, June 30, September 30, and December 31 and can be downloaded directly. If a bridge letter covering a different period end date or product scope is required, please contact sales or support.

SOC 1 reports may be requested via the Compliance Reports Manager. Potential customers can contact sales for more information.