Certificate

Certificate number: 2018-014 Certified by EY CertifyPoint since: July 10, 2018

Based on certification examination in conformity with defined requirements in Multi-Tier Cloud Security – SS 584:2015 as defined and implemented by

Google Asia Pacific Pte Ltd*

located in 70 Pasir Panjang Road, Mapletree Business City, Singapore 117371 is compliant with the Level 3 requirements as stated in the standard: Multi-Tier Cloud Security (MTCS) – SS 584:2015 Issue date of certificate: August 28, 2018 Expiration date of certificate: July 9, 2021

EY CertifyPoint will, according to the certification agreement dated December 17, 2015, perform surveillance audits and acknowledge the certificate until the expiration date noted above.

*The certification is applicable for the assets, services and locations as described in the scoping section on the back of this certificate, with regard to the specific requirements for multi-tier cloud security.

J. Sehgal | Director, EY CertifyPoint

This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, The Netherlands. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to the referred MTCS standard. The certificate does not grant immunity from any legal/regulatory obligations. All right reserved. © Copyright

Page 1 of 3 Digital version

Google Asia Pacific Pte Ltd

Scope for certificate 2018-014

The scope refers to level 3 of Multi-Tier Cloud Security System of Google Asia Pacific Pte Ltd located in 70 Pasir Panjang Road, Mapletree Business City, Singapore 117371 supporting the provision of Google Cloud using Infrastructure-as-a-service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS) model.

Google Cloud Platform  App Engine  Cloud Router  App Engine Flexible Environment  Cloud SDK  BigQuery  Cloud Security Scanner  BigQuery Data Transfer Service  Cloud Shell  Cloud Armor  Cloud Source Repositories  Cloud  Cloud  Cloud Billing API  Cloud Speech-to-Text  Cloud CDN  Cloud SQL  Cloud Console  Cloud Storage  Cloud Console Mobile App  Cloud Storage Transfer Service  Cloud Dataflow  Cloud Translation API  Cloud Datalab  Cloud Video Intelligence API  Cloud Dataproc  Cloud Vision API  Cloud Datastore  Cloud VPN  Cloud Deployment Manager  Compute Engine  Cloud DNS  Container Builder  Cloud Endpoints  Container Registry  Cloud Firestore  Data Loss Prevention API  Cloud Functions  Enterprise Edition  Cloud Healthcare API  Genomics  Cloud Identity & Access  Google Service Control Management  Engine  Cloud Identity-Aware Proxy   Cloud Interconnect  Persistent Disk  Cloud IoT Core  Service Consumer  Cloud Jobs Discovery Management API  Cloud Key Management Service  Service Management API  Cloud Launcher  Stackdriver Debugger  Cloud Load Balancing  Stackdriver Error Reporting  Cloud Machine Learning Engine  Stackdriver Logging  Cloud Natural Language API  Stackdriver Profiler  Cloud Pub/Sub  Stackdriver Trace  Cloud Resource Manager  Transfer Appliance  Virtual Private Cloud (VPC)

This scope (edition: July 10, 2018) is only valid in connection with certificate 2018-014.

Page 2 of 3 Digital version

Google Asia Pacific Pte Ltd

Scope for certificate 2018-014

The following locations are in scope:

Data Centers:

 Atlanta, Georgia, United States of  Moncks Corner, South Carolina, America (ATL/IDI) United States of America  Atlanta, Georgia, United States of (CHS/MNK) America (ATL/MET)  Pryor Creek, Oklahoma, United  Changhua, Taiwan (TPE/CHG) States of America (TUL/PRY)  Council Bluffs, Iowa, United States  Quilicura, Santiago, Chile of America (CBF/CBF) (SCL/QCA)  Council Bluffs (Southland), Iowa,  Wenya, Singapore (SIN/WEN) United States of America (CBF/SLN)  Koto-ku, Tokyo, Japan (KOT)  The Dalles, Oregon, United States of  Ashburn, Virginia, United States America (DLS/DLS) of America (IAD)  Dublin, Ireland (DUB/PPK)  London, United Kingdom (SGH)  Eemshaven, Groningen, Netherlands  Frankfurt, Hesse, Germany (ROD) (GRQ/EEM)  Sydney, NSW, Australia (MQP)  Ghlin, Hainaut, Belgium (BRU/GBL)  Montreal, Quebec, Canada (YUL)  Hamina, Finland (LPP/LPP)  Sao Paulo, Brazil (OCO)  Lenoir, North Carolina, United  Mumbai, India (MRL) States of America (CHS/MNK)

This scope (edition: July 10, 2018) is only valid in connection with certificate 2018-014.

Page 3 of 3 Digital version

DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05 DocuSign Envelope ID: EDB7FB5E-8B2D-4197-8A43-12220C5A225D8CA2DED5-DD74-4D3D-A0D1-7C48571E8E05