Our dedicated security team Google employs more than 550 full-time security and privacy professionals, who are part of our software engineering and operations division. Our team includes some of the world’s foremost experts in information, application and network security. This team is tasked with maintaining the company’s defense systems, developing security review processes, building Google employs more than security infrastructure and implementing Google’s security policies. Google’s dedicated security team actively scans for security threats using commercial 550 full-time security and and custom tools, penetration tests, quality assurance (QA) measures and privacy professionals, software security reviews. who are part of our Within Google, members of the information security team review security software engineering and plans—for—all—networks,—systems—and—services.—They—provide—project-speciic— consulting services to Google’s product and engineering teams. operations division. They monitor for suspicious activity on Google’s networks, address Our team includes some of information security threats, perform routine security evaluations and audits, and engage outside experts to conduct regular security assessments. the world’s foremost experts We—speciically—built—a—full-time—team,—known—as—Project Zero, that aims to in information, application prevent—targeted—attacks—by—reporting—bugs—to—software—vendors—and—iling— them in an external database. and network security. The security team also takes part in research and outreach activities to protect the wider community of Internet users, beyond just those who choose Google solutions. Some examples of this research would be the discovery of the POODLE SSL 3.0 exploit and cipher suite weaknesses. The security team also publishes security research papers, available to the public. The security team also organizes and participates in open-source projects and academic conferences. Our dedicated privacy team The Google Privacy team operates independently from product development and security organizations, but participates in every Google product launch. The team reviews design documentation and code audits to ensure that privacy requirements are followed. The Privacy team has built a set of automated monitoring tools to help ensure that products with Customer Data operate as designed and in accordance with our privacy policy.—They—help—release—products—that—relect—strong—privacy—standards:— transparent collection of user data and providing users and administrators with—meaningful—privacy—coniguration—options,—while—continuing—to—be—good— stewards of any information stored on our platform. After products launch, the—privacy—team—oversees—automated—processes—that—audit—data—traic— to verify appropriate data usage. In addition, the privacy team conducts research providing thought leadership on privacy best practices for our emerging technologies. 3

Google Cloud Security and Compliance Whitepaper - Page 7 Google Cloud Security and Compliance Whitepaper Page 6 Page 8