Google Cloud regularly undergoes third-party audits for our products, systems, and infrastructure related to this standard. The SOC 2 reports are generated by an objective third party attesting to a set of assertions made by Google Cloud about its controls that are in place to protect customer data. The audit firm’s evaluation includes comprehensive testing of the design and operating effectiveness of the controls within the audit period. 

Customers may use the SOC 2 report to assess the risks arising from interactions with the assessed Google Cloud and Google Workspace systems throughout the period.

The core Google Cloud and Google Workspace SOC 2 Type II reports are issued semi-annually and can be downloaded via the Compliance Reports Manager. The coverage periods and issuance dates for these reports are:

• First half of the year 
• Coverage period: May 1 - April 30
• Estimated issuance: mid-June
• Second half of the year 
• Coverage period: November 1 - October 31
• Estimated issuance: mid-December

We issue separate SOC 2 Type II reports for a small subset of Google Cloud products, including AppSheet, Backup and Disaster Recovery, Google Cloud VMware Engine, Bare Metal Solution, Apigee Edge, Actifio Heritage, StratoZone, Google Security Operations SOAR, Mandiant, and Looker (Google Cloud core). These reports are issued annually and customers can obtain these reports by contacting sales or support.

Bridge letters are attestations made by the management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. Bridge letters are available for SOC 1 and SOC 2 reports.

Google Cloud creates monthly bridge letters with each letter designed to cover the period since the most recent SOC report. For example, Google Cloud issues a bridge letter in early January to cover the look-back period of November 1 to December 31, which extends the coverage period of the previously issued SOC report with a period end date of October 31.

SOC bridge letters for the core Google Cloud and Google Workspace SOC 2 reports are made available on Compliance Reports Manager for the periods ending March 31, June 30, September 30, and December 31 and can be downloaded directly. If a bridge letter covering a different period end date or product scope is required, please contact sales or support.

SOC 2 reports may be requested via the Compliance Reports Manager. Potential customers can contact sales for more information.