Standards, Regulations & Certifications

To help you with compliance and reporting, we share information, best practices, and easy access to documentation. Our products regularly undergo independent verification of security, privacy, and compliance controls, achieving certifications against global standards to earn your trust. We’re constantly working to expand our coverage.
arrow_backBACK

SOC 3

Public report of controls over security, availability, and confidentiality.

SOC 3 is based on the existing SysTrust and WebTrust principles. Unlike SOC 1 and 2, SOC 3 reports for Google Cloud Platform and G Suite can be freely distributed to the public for general use. Google Cloud undergoes a regular third-party audit to certify individual products against this standard.

SSAE 16 / ISAE 3402 Type II

The Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA) created the Statement on Standards for Attestation Engagements No. 16 (SSAE 16) to keep pace with globally recognized international accounting standards.

SSAE 16 aligns closely with the International Standard on Assurance Engagements 3402 (ISAE 3402).

SSAE 16 and ISAE 3402 are used to generate a report by an objective third-party attesting to a set of statements which an organization asserts about its controls. The Service Organization Controls (SOC) framework is the method by which the control of financial information is measured.

Google Cloud services that are in scope for SOC 3:

Google Cloud Platform:
G Suite:
Additional Google Products:
Google Product APIs:
G Suite Admin SDK:
Supporting Services:
  • Gmail Delivery
  • Gmail Frontend/Middleware
  • Gmail Medley
  • Gmail Spam

Related Standards & Certifications

SOC 1

Controls over financial reporting.

Learn More

SOC 2

Controls over security, availability, and confidentiality.

Learn More