DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Certificate
Certificate number: 2016-004a
Certified by EY CertifyPoint since: April 15, 2016

Based on certification examination in conformity with defined requirements in ISO/IEC

17021-1:2015 and ISO/IEC 27006:2015/A1:2020, the Information Security
Management System as defined and implemented by

Google LLC*
located in Mountain View, California, United States of America is compliant with the
requirements as stated in the standard:

ISO/IEC 27017:2015
Issue date of certificate: May 3, 2021
Re-issue date of certificate: January 25, 2024
Expiration date of certificate: May 14, 2024
Last certification cycle expiration date: May 15, 2021

EY CertifyPoint will, according to the certification agreement dated May 23, 2022,
perform surveillance audits and acknowledge the certificate until the expiration date
noted above or the expiration of the corresponding ISO/IEC 27001:2022 certification
with certificate number 2012-001a.

*The certification is applicable for the assets, services and locations as described in the scoping section at
the back of this certificate, with regard to the specific requirements for information security as stated in
the Statement of Applicability dated August 9, 2023.

J. Sehgal | Director, EY CertifyPoint

Disclaimer: This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this
certificate shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must
adhere to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form
of assurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

The scope of this ISO/IEC 27017:2015 certification is limited to Enterprise Customers

and bounded by the following product area and its offering(s) as listed below, along with
the data contained or collected by those offering(s).

Google Workspace:
➢ Admin Console* ➢ Google Jamboard*
➢ Assignments* ➢ Google Keep*
➢ Classroom* ➢ Google Meet*
➢ Cloud Identity* ➢ Google Sheets*
➢ Cloud Search* ➢ Google Sites*
➢ Google Calendar* ➢ Google Slides*
➢ Google Chat* ➢ Google Tasks*
➢ Google Contacts* ➢ Google Vault*
➢ Google Docs* ➢ Google Voice*
➢ Google Drive* ➢ Google Workspace Migrate
➢ Google Forms* ➢ Gmail*
➢ Google Groups* ➢ Mobile Device Management*

* Indicates that the scope of this certification applies to this offering where Google acts as a processor of Service Data (in addition
to Google acting as a processor of Customer Data). Google’s processing of Service Data as a processor is subject to agreement with
relevant enterprise customers of this offering.

The following locations are in scope:

Data Centers:
➢ Arcola (VA), United States of ➢ Columbus (1) (OH), United
America States of America
➢ Ashburn (1) (VA), United States ➢ Columbus (2) (OH), United
of America States of America
➢ Ashburn (2) (VA), United States ➢ Council Bluffs (1) (IA), United
of America States of America
➢ Ashburn (3) (VA), United States ➢ Council Bluffs (2) (IA), United
of America States of America
➢ Atlanta (1) (GA), United States ➢ Dammam, Saudi Arabia
of America ➢ Delhi (1), India
➢ Berlin, (1) Germany ➢ Delhi (2), India
➢ Berlin, (2) Germany ➢ Doha (1), Qatar
➢ Berlin, (3) Germany ➢ Doha (2), Qatar
➢ Changhua, Taiwan ➢ Dublin, Ireland
➢ Clarksville (TN), United States ➢ Eemshaven, Groningen, The
of America Netherlands

This scope is only valid in connection with certificate 2016-004a.

Page 2 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

Data Centers (continued):

➢ Frankfurt (1), Hesse, Germany ➢ Los Angeles (2) (CA), United
➢ Frankfurt (2), Hesse, Germany States of America
➢ Frankfurt (4), Hesse, Germany ➢ Los Angeles (3) (CA), United
➢ Frankfurt (5), Hesse, Germany States of America
➢ Frankfurt (6), Hesse, Germany ➢ Loyang, Singapore
➢ Frankfurt (7), Hesse, Germany ➢ Madrid (1), Spain
➢ Frankfurt (8), Hesse, Germany ➢ Madrid (2), Spain
➢ Fredericia, Denmark ➢ Madrid (3), Spain
➢ Ghlin, Hainaut, Belgium ➢ Melbourne, (1) Victoria,
➢ Hamina, Finland Australia
➢ Henderson (NV), United States ➢ Melbourne, (2) Victoria,
of America Australia
➢ Hong Kong (1), Hong Kong ➢ Middenmeer, Noord-Holland,
➢ Hong Kong (2), Hong Kong The Netherlands
➢ Hong Kong (3), Hong Kong ➢ Midlothian (TX), United States
➢ Inzai City, Chiba, Japan of America
➢ Jakarta (1), Indonesia ➢ Milan (1), Italy
➢ Jakarta (2), Indonesia ➢ Milan (2), Italy
➢ Jakarta (3), Indonesia ➢ Milan (3), Italy
➢ Johannesburg (1), South Africa ➢ Moncks Corner (SC), United
➢ Johannesburg (2), South Africa States of America
➢ Johannesburg (3), South Africa ➢ Montreal (1), Quebec, Canada
➢ Koto-ku (1), Tokyo, Japan ➢ Montreal (2), Quebec, Canada
➢ Koto-ku (2), Tokyo, Japan ➢ Mumbai (1), India
➢ Koto-ku (3), Tokyo, Japan ➢ Mumbai (2), India
➢ Lancaster (OH), United States ➢ Mumbai (3), India
of America ➢ Mumbai (4), India
➢ Las Vegas (NV), United States ➢ New Albany (OH), United States
of America of America
➢ Leesburg (VA), United States of ➢ Osaka, Japan
America ➢ Osasco, Brazil
➢ Lenoir (NC), United States of ➢ Papillion (NE), United States of
America America
➢ Lok Yang Way, Singapore ➢ Paris (1), France
➢ London (1), United Kingdom ➢ Paris (2),France
➢ London (3), United Kingdom ➢ Paris (3), France
➢ London (4), United Kingdom ➢ Phoenix (AZ), United States of
➢ London (5), United Kingdom America
➢ London (6), United Kingdom ➢ Pryor Creek (OK), United States
➢ Los Angeles (1) (CA), United of America
States of America ➢ Quilicura, Santiago, Chile

This scope is only valid in connection with certificate 2016-004a.

Page 3 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

Data Centers (continued):

➢ Reno (NV), United States of ➢ The Dalles (1) (OR), United
America States of America
➢ Salt Lake City (1) (UT), United ➢ The Dalles (2) (OR), United
States of America States of America
➢ Salt Lake City (2) (UT), United ➢ Toronto, Ontario, Canada
States of America ➢ Turin (1), Italy
➢ Salt Lake City (3) (UT), United ➢ Turin (2), Italy
States of America ➢ Turin (3), Italy
➢ Seoul (1), South Korea ➢ Vinhedo, Brazil
➢ Seoul (2), South Korea ➢ Warsaw (1), Poland
➢ Seoul (3), South Korea ➢ Warsaw (2), Poland
➢ Sydney (1), NSW, Australia ➢ Warsaw (3), Poland
➢ Sydney (2), NSW, Australia ➢ Wenya, Singapore
➢ Sydney (3), NSW, Australia ➢ Widows Creek (AL), United
➢ Sydney (4), NSW, Australia States of America
➢ Tel Aviv (1), Israel ➢ Zurich,(1) Switzerland
➢ Tel Aviv (2), Israel ➢ Zurich, (2) Switzerland
➢ Tel Aviv (3), Israel

Offices:
➢ Accra, Ghana ➢ Boston (MA), United States of
➢ Addison (TX), United States of America
America ➢ Bothell (WA), United States of
➢ Amsterdam, The Netherlands America
➢ Ann Arbor (MI), United States of ➢ Boulder (CO), United States of
America America
➢ Athens, Greece ➢ Brisbane, Australia
➢ Atlanta (GA), United States of ➢ Brussels, Belgium
America ➢ Bucharest, Romania
➢ Auckland, New Zealand ➢ Budapest, Hungary
➢ Austin (TX), United States of ➢ Buenos Aires, Argentina
America ➢ Cairo, Egypt
➢ Bangalore, India ➢ Calgary, Alberta, Canada
➢ Bangkok, Thailand ➢ Cambridge (MA), United States
➢ Barcelona, Spain of America
➢ Beijing, China ➢ Cebu City, Philippines
➢ Bellevue (WA), United States of ➢ Chapel Hill (NC), United States of
America America
➢ Belo Horizonte, Brazil ➢ Charlotte (NC), United States of
➢ Berlin, Germany America
➢ Bogota, Colombia

This scope is only valid in connection with certificate 2016-004a.

Page 4 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

Offices (continued):
➢ Chicago (IL), United States of ➢ Los Angeles (CA), United States
America of America
➢ Copenhagen, Denmark ➢ Madison (WI), United States of
➢ Detroit (MI), United States of America
America ➢ Madrid, Spain
➢ Doha, Qatar ➢ Malaga, Spain
➢ Dubai, United Arab Emirates ➢ Manchester, United Kingdom
➢ Dublin, Ireland ➢ Manila, Philippines
➢ Durham (NC), United States of ➢ Melbourne, Australia
America ➢ Mexico City, Mexico
➢ Espoo, Finland ➢ Miami (FL), United States of
➢ Frankfurt, Germany America
➢ Fremont (CA), United States of ➢ Milan, Italy
America ➢ Montreal, Québec, Canada
➢ Gdansk, Poland ➢ Mountain View (CA), United
➢ Ghent, Belgium States of America
➢ Goleta (CA), United States of ➢ Mumbai, India
America ➢ Munich, Germany
➢ Grenoble, France ➢ Nairobi, Kenya
➢ Gurgaon, India ➢ Nashville (TN), United States of
➢ Haifa, Israel America
➢ Hamburg, Germany ➢ New Delhi, India
➢ Hanoi, Vietnam ➢ New Taipei City, Taiwan
➢ Helsinki, Finland ➢ New York (NY), United States of
➢ Hong Kong, Hong Kong America
➢ Houston (TX), United States of ➢ Osaka, Japan
America ➢ Oslo, Norway
➢ Hyderabad, India ➢ Ottawa, Ontario, Canada
➢ Irvine (CA), United States of ➢ Ottignies-Louvain-la-Neuve,
America Belgium
➢ Istanbul, Turkey ➢ Palo Alto (CA), United States of
➢ Johannesburg, South Africa America
➢ Kirkland (WA), United States of ➢ Paris, France
America ➢ Perth, Australia
➢ Kitchener, Canada ➢ Pittsburgh (PA), United States of
➢ Krakow, Poland America
➢ Kuala Lumpur, Malaysia ➢ Playa Vista (CA), United States
➢ Lagos, Nigeria of America
➢ Lima, Peru ➢ Portland (OR), United States of
➢ Lisbon, Portugal America
➢ London, United Kingdom ➢ Prague, Czech Republic

This scope is only valid in connection with certificate 2016-004a.

Page 5 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

Offices (continued):
➢ Princeton (NJ), United States of ➢ South Jakarta, Indonesia
America ➢ South San Francisco (CA),
➢ Pune, India United States of America
➢ Quezon City, Philippines ➢ Southaven (MS), United States
➢ Ramat Gan, Israel of America
➢ Redmond (WA), United States of ➢ Stockholm, Sweden
America ➢ Sunnyvale (CA), United States of
➢ Redwood City (CA), United America
States of America ➢ Sydney, Australia
➢ Reston (VA), United States of ➢ Taipei, Taiwan
America ➢ Taoyuan, Taiwan
➢ Rome, Italy ➢ Tel Aviv, Israel
➢ Salt Lake City (UT), United ➢ Thornton (CO), United States of
States of America America
➢ San Bruno (CA), United States of ➢ Tokyo, Japan
America ➢ Toronto, Canada
➢ San Diego (CA), United States of ➢ Vancouver, Canada
America ➢ Viby, Denmark
➢ San Francisco (CA), United ➢ Vienna, Austria
States of America ➢ Vilnius, Lithuania
➢ San Jose (CA), United States of ➢ Virginia (VA), United States of
America America
➢ Santa Cruz (CA), United States ➢ Warsaw, Poland
of America ➢ Washington (WA), United States
➢ Santiago, Chile of America
➢ Sao Paulo, Brazil ➢ Washington, D.C. United States
➢ Seattle (WA), United States of of America
America ➢ Wroclaw, Poland
➢ Seoul, South Korea ➢ Zagreb, Croatia
➢ Shanghai, China ➢ Zhubei City, Taiwan
➢ Shenzhen, China ➢ Zurich, Switzerland
➢ Singapore, Singapore

The ISMS is centrally managed out of the Google LLC headquarters in Mountain View,
California, United States of America. The ISMS mentioned in the above scope is restricted
as defined in the ‘Google Cloud Services Information Security Management System
(ISMS) Implementation Manual’, reviewed on September 21, 2023, by the Cloud Core
Certifications Lead.

This scope is only valid in connection with certificate 2016-004a.

Page 6 of 7 Digital version

DocuSign Envelope ID: A71DB465-9565-4821-8B9B-D3A5DA9DE267

Google LLC
Scope for certificate 2016-004a

Google LLC (Google Cloud) provides consulting services to its customers. The consulting
team “Google Cloud Professional Services Organization” is included in the Google Cloud
ISMS.

This scope is only valid in connection with certificate 2016-004a.

Page 7 of 7 Digital version