Encrypting data in transit, at rest and backup media G Suite customers’ data is encrypted when it’s on a disk, stored on backup media, moving over the Internet, or traveling between data centers. Providing cryptographic solutions that address customers’ data security concerns is our commitment. Encryption is an important piece of the G Suite security strategy, helping to protect your emails, chats, Google Drive iles,—and—other—data.—Additional—details—on—how—data—is—protected—at—rest,—in— transit, on backup media and details on encryption key management can be found in our G Suite Encryption Whitepaper. Low latency and highly available solution Google designs the components of our platform to be highly redundant. This redundancy applies to our server design, how we store data, network Google’s data centers are and Internet connectivity, and the software services themselves. This “redundancy of everything” includes the handling of errors by design geographically distributed and creates a solution that is not dependant on a single server, data center, or network connection. Google’s data centers are geographically distributed to—minimize—the—efects—of— to—minimize—the—efects—of—regional—disruptions—such—as—natural—disasters—and—regional disruptions such local outages. In the event of hardware, software, or network failure, data is as natural disasters and automatically shifted from one facility to another so that G Suite customers can continue working in most cases without interruption. Customers with local outages. global workforces can collaborate on documents, video conferencing and more—without—additional—coniguration—or—expense.—Global—teams—share—a— highly performant and low latency experience as they work together on a single global network. Google’s highly redundant infrastructure also helps protect our customers from data loss. For G Suite, our recovery point objective (RPO) target is zero, and our recovery time objective (RTO) design target is also zero. We aim to achieve these targets through live or synchronous replication: actions you take in G Suite Products are simultaneously replicated in two data centers at once, so that if one data center fails, we transfer your data over to—the—other—one—that’s—also—been—relecting—your—actions.—Customer—data—is— divided—into—digital—pieces—with—random—ile—names.—Neither—their—content—nor— their—ile—names—are—stored—in—readily—human-readable—format,—and—stored— customer data cannot be traced to a particular customer or application just by inspecting it in storage. Each piece is then replicated in near-real time over multiple disks, multiple servers, and multiple data centers to avoid a single point of failure. To further prepare for the worst, we conduct disaster recovery drills in which we assume that individual data centers—including our corporate headquarters—won’t be available for 30 days. We regularly test our readiness for plausible scenarios as well as more imaginative crises, 9

Google Cloud Security and Compliance Whitepaper - Page 13 Google Cloud Security and Compliance Whitepaper Page 12 Page 14