activity records, and camera footage are available in case an incident occurs. Data centers are also routinely patrolled by experienced security guards who have undergone rigorous background—checks—and—training.—As—you—get—closer—to—the—data—center—loor,—security—measures— also—increase.—Access—to—the—data—center—loor—is—only—possible—via—a—security—corridor—which— implements multifactor access control using security badges and biometrics. Only approved employees—with—speciic—roles—may—enter.—Less—than—one—percent—of—Googlers—will—ever—step—foot—in— one of our data centers. Powering our data centers To keep things running 24/7 and ensure uninterrupted services, Google’s data centers feature redundant power systems and environmental controls. Every critical component has a primary and alternate power source, each with equal power. Diesel engine backup generators can provide enough emergency electrical power to run each data center at full capacity. Cooling systems maintain a constant operating temperature for servers and other hardware, reducing the risk of service outages. Fire detection and suppression equipment helps prevent damage—to—hardware.—Heat,—ire,—and—smoke—detectors—trigger—audible—and—visible—alarms—in—the— afected—zone,—at—security—operations—consoles,—and—at—remote—monitoring—desks.—— Environmental impact Google reduces environmental impact of running our data centers by designing and building our own facilities. We install smart temperature controls, use “free-cooling” techniques like using outside air or reused water for cooling, and redesign how power is distributed to reduce unnecessary energy loss. To gauge improvements, we calculate the performance of each—facility—using—comprehensive—eiciency—measurements.—We’re—the—irst—major—Internet— services—company—to—gain—external—certiication—of—our—high—environmental,—workplace—safety— and—energy—management—standards—throughout—our—data—centers.—Speciically,—we—received— voluntary ISO 14001, OHSAS 18001 and ISO 50001—certiications.—In—a—nutshell,—these— standards are built around a very simple concept: Say what you’re going to do, then do what you say—and then keep improving. Custom server hardware and software Google’s—data—centers—house—energy-eicient—custom,—purpose-built—servers—and—network equipment that we design and manufacture ourselves. Unlike much commercially available hardware, Google servers don’t include unnecessary components such as video cards, chipsets, or peripheral connectors, which can introduce vulnerabilities. Our production servers run a custom-designed operating system (OS) based on a stripped-down and hardened version of Linux. Google’s servers and their OS are designed for the sole purpose of providing Google services.—Server—resources—are—dynamically—allocated,—allowing—for—lexibility—in—growth—and—the— ability—to—adapt—quickly—and—eiciently,—adding—or—reallocating—resources—based—on—customer— demand. This homogeneous environment is maintained by proprietary software that continually monitors—systems—for—binary—modiications.—If—a—modiication—is—found—that—difers—from—the— standard—Google—image,—the—system—is—automatically—returned—to—its—oicial—state.— These automated, self-healing mechanisms are designed to enable Google to monitor and remediate—destabilizing—events,—receive—notiications—about—incidents,—and—slow—down—potential— compromise on the network. 7

Google Cloud Security and Compliance Whitepaper - Page 11 Google Cloud Security and Compliance Whitepaper Page 10 Page 12