Sovereign Controls by Partners

Customer data will be stored at rest in specific Google Cloud regions and restricted from moving outside of the specified regions.

Encryption keys are stored and managed by partners outside of Google’s infrastructure.

Decrypting customer data requires a call outside of Google for the customer’s externally managed key.

Customers can expect every request to come with a justification and block requests programmatically for any reason.

Technical support access is limited by underlying data access controls and routed to persons meeting specific criteria.

Administrative access to customer data and workloads is logged, audited, and permitted only under predefined conditions.