Certificate

Certificate number: 2012-001b Certified by EY CertifyPoint since: May 11, 2012

Based on certification examination in conformity with defined requirements in ISO/IEC 17021-1:2015 and ISO/IEC 27006:2015, the Information Security Management System as defined and implemented by

Google LLC*

located in Mountain View, California, United States of America is compliant with the requirements as stated in the standard: ISO/IEC 27001:2013 Issue date of certificate: April 13, 2018 Re-issue date of certificate: April 17, 2020 Expiration date of certificate: April 13, 2021 Last certification cycle expiration date: April 14, 2018

EY CertifyPoint will, according to the certification agreement dated April 8, 2019, perform surveillance audits and acknowledge the certificate until the expiration date noted above.

*The certification is applicable for the assets, services and locations as described in the scoping section at the back of this certificate, with regard to the specific requirements for information security as stated in the Statement of Applicability dated February 27, 2020.

J. Sehgal | Director, EY CertifyPoint

Disclaimer: This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 6 Digital version

Google LLC

Scope for certificate 2012-001b

The scope of this ISO/IEC 27001:2013 certification is bounded by the following product and its offerings as listed below, along with the data contained or collected by those offerings.

Google Cloud Platform ➢ Access Approval ➢ Cloud Life Sciences (formerly ➢ Access Context Manager Google Genomics) ➢ Access Transparency ➢ Cloud Load Balancing ➢ AI Platform Data Labeling ➢ Cloud NAT (Network Address ➢ AI Platform Notebooks Translation) ➢ AI Platform Training and ➢ Cloud Natural Language API Prediction ➢ Cloud Router ➢ Hybrid ➢ Cloud Run (fully managed) ➢ App Engine ➢ Cloud Run for Anthos ➢ AutoML Natural Language ➢ Cloud SDK ➢ AutoML ➢ Cloud Shell ➢ AutoML Translation ➢ Cloud Source Repositories ➢ AutoML Video ➢ Cloud ➢ AutoML Vision ➢ Cloud SQL ➢ BigQuery ➢ ➢ BigQuery Data Transfer Service ➢ Cloud Storage for ➢ Cloud Asset Inventory ➢ Cloud Translation ➢ Cloud ➢ Cloud Vision ➢ Cloud Billing API ➢ Cloud VPN ➢ Cloud Build ➢ Compute Engine ➢ Cloud CDN ➢ Container Registry ➢ Cloud Composer ➢ Data Catalog ➢ Cloud Console ➢ Dataflow ➢ Cloud Console App ➢ Datalab ➢ Cloud Data Fusion ➢ Dataproc ➢ Cloud Data Loss Prevention ➢ Datastore ➢ Cloud Deployment Manager ➢ Dialogflow ➢ Cloud DNS ➢ Event Threat Detection ➢ Cloud Endpoints ➢ Firebase Authentication ➢ Cloud Filestore ➢ Firebase Test Lab ➢ Cloud Functions ➢ Firestore ➢ Cloud Functions for Firebase ➢ GCP Marketplace ➢ Cloud Healthcare ➢ GKE Connect ➢ Cloud HSM ➢ GKE Hub ➢ Cloud Interconnect ➢ Google Cloud Armor ➢ Cloud Key Management Service ➢ Google Cloud Identity-Aware Proxy

This scope is only valid in connection with certificate 2012-001b.

Page 2 of 6 Digital version

Google LLC

Scope for certificate 2012-001b

Google Cloud Platform (Continued): ➢ Google Engine ➢ Speech-to-Text ➢ Identity & Access Management ➢ Stackdriver Debugger (IAM) ➢ Stackdriver Error Reporting ➢ Identity Platform ➢ Stackdriver Logging ➢ IoT Core ➢ Stackdriver Monitoring ➢ Managed Service for ➢ Stackdriver Profiler Active Directory (AD) ➢ Stackdriver Trace ➢ Memorystore ➢ Storage Transfer Service ➢ Network Service Tiers ➢ Talent Solution ➢ ➢ Text-to-Speech ➢ Persistent Disk ➢ Traffic Director ➢ Pub/Sub ➢ Transfer Appliance ➢ Resource Manager API ➢ Video Intelligence API ➢ Security Command Center ➢ ➢ Service Consumer Management ➢ VPC Service Controls ➢ Service Control ➢ Web Security Scanner ➢ Service Management

The following locations are in scope:

Data Centers: ➢ Arcola (VA), United States of ➢ Eemshaven, Groningen, The America Netherlands ➢ Ashburn (1) (VA), United States of ➢ Frankfurt (1), Hesse, Germany America ➢ Frankfurt (2), Hesse, Germany ➢ Ashburn (2) (VA), United States of ➢ Frankfurt (3), Hesse, Germany America ➢ Ghlin, Hainaut, Belgium ➢ Ashburn (3) (VA), United States of ➢ Hamina, Finland America ➢ Hong Kong, Hong Kong ➢ Atlanta (1) (GA), United States of ➢ Jakarta, Indonesia America ➢ Koto-ku, Tokyo, Japan ➢ Atlanta (2) (GA), United States of ➢ Las Vegas (NV), United States of America America ➢ Changhua, Taiwan ➢ Leesburg (VA), United States of ➢ Clarksville (TN), United States of America America ➢ Lenoir (NC), United States of ➢ Council Bluffs (1) (IA), United America States of America ➢ London (1), United Kingdom ➢ Council Bluffs (2) (IA), United ➢ London (2), United Kingdom States of America ➢ Los Angeles (CA), United States of ➢ Dublin, Ireland America

This scope is only valid in connection with certificate 2012-001b.

Page 3 of 6 Digital version

Google LLC

Scope for certificate 2012-001b

Data Centers (Continued): ➢ Middenmeer, Noord-Holland, The ➢ Seoul, South Korea Netherlands ➢ Sydney (1), NSW, Australia ➢ Moncks Corner (SC), United States ➢ Sydney (2), NSW, Australia of America ➢ The Dalles (1) (OR), United States ➢ Montreal, Quebec, Canada of America ➢ Mumbai, India ➢ The Dalles (2) (OR), United States ➢ Osaka, Japan of America ➢ Osasco, Brazil ➢ Vinhedo, Brazil ➢ Pryor Creek (OK), United States of ➢ Wenya, Singapore America ➢ Widows Creek (AL), United States ➢ Quilicura, Santiago, Chile of America ➢ Salt Lake City (UT), United States ➢ Zurich, Switzerland of America

Offices: ➢ Aarhus, Denmark ➢ Budapest, Hungary ➢ Accra, Ghana ➢ Buenos Aires, Argentina ➢ Addison (TX), United States of ➢ Cambridge (MA), United States of America America ➢ Amsterdam, The Netherlands ➢ Changhua, Taiwan ➢ Ann Arbor (MI), United States of ➢ Chapel Hill (NC), United States of America America ➢ Atlanta (GA), United States of ➢ Chicago (IL), United States of America America ➢ Austin (TX), United States of ➢ Clarksville (TN), United States of America America ➢ Bangalore, India ➢ Copenhagen, Denmark ➢ Bangkok, Thailand ➢ Council Bluffs (IA), United States of ➢ Baudour, Belgium America ➢ Beijing, China ➢ Dubai, UAE ➢ Bellevue (WA), United States of ➢ Dublin, Ireland America ➢ Eemshaven, The Netherlands ➢ Belo Horizonte, Brazil ➢ Frankfurt, Germany ➢ Berlin, Germany ➢ Goleta (CA), United States of ➢ Beverly Hills (CA), United States of America America ➢ Grenoble, France ➢ Bogota, Colombia ➢ Guangdong Province, China ➢ Boulder (CO), United States of ➢ Gurgaon, India America ➢ Haifa, Israel ➢ Bridgeport (AL), United States of ➢ Hamburg, Germany America ➢ Hamina, Finland ➢ Brussels, Belgium ➢ Helsinki, Finland

This scope is only valid in connection with certificate 2012-001b.

Page 4 of 6 Digital version

Google LLC

Scope for certificate 2012-001b

Offices (Continued): ➢ Hong Kong, Hong Kong ➢ Omaha (NE), United States of ➢ Hyderabad, India America ➢ Irvine (CA), United States of ➢ Oslo, Norway America ➢ Oude Meer, The Netherlands ➢ Istanbul, Turkey ➢ Palo Alto (CA), United States of ➢ Johannesburg, South Africa America ➢ Kiev, Ukraine ➢ Paris, France ➢ Kirkland (WA), United States of ➢ Pittsburgh (PA), United States of America America ➢ Kitchener, Canada ➢ Playa Vista (CA), United States of ➢ Krakow, Poland America ➢ Lagos, Nigeria ➢ Portland (OR), United States of ➢ Leesburg (VA), United States of America America ➢ Prague, Czech Republic ➢ Lenoir (NC), United States of ➢ Princeton (NJ), United States of America America ➢ Lithia Springs (GA), United States ➢ Pryor Creek (OK), United States of of America America ➢ London, United Kingdom ➢ Pune, India ➢ Los Angeles (CA), United States of ➢ Redmond (WA), United States of America America ➢ Madison (WI), United States of ➢ Redwood City (CA), United States America of America ➢ Madrid, Spain ➢ Reston (VA), United States of ➢ Malaga, Spain America ➢ Manila, Philippines ➢ Rome, Italy ➢ Mexico City, Mexico ➢ San Bruno (CA), United States of ➢ Miami (FL), United States of America America ➢ San Diego (CA), United States of ➢ Milan, Italy America ➢ Moncks Corner (SC), United States ➢ San Francisco (CA), United States of America of America ➢ Montreal, Québec, Canada ➢ Santiago, Chile ➢ Moscow, Russia ➢ Sao Paulo, Brazil ➢ Mountain View (CA), United States ➢ Seattle (WA), United States of of America America ➢ Mumbai, India ➢ Seoul, Korea ➢ Munich, Germany ➢ Shanghai, China ➢ Nairobi, Kenya ➢ Singapore, Singapore ➢ New Taipei City, Taiwan ➢ South Jakarta, Indonesia ➢ New York (NY), United States of ➢ Sterling (VA), United States of America America

This scope is only valid in connection with certificate 2012-001b.

Page 5 of 6 Digital version

Google LLC

Scope for certificate 2012-001b

Offices (Continued): ➢ Stockholm, Sweden ➢ Thornton (CO), United States of ➢ Sunnyvale (CA), United States of America America ➢ Tokyo, Japan ➢ Sydney, Australia ➢ Toronto, Canada ➢ Tainan City, Taiwan ➢ Warsaw, Poland ➢ Taipei, Taiwan ➢ Washington, United States of ➢ Taoyuan, Taiwan America ➢ Tel Aviv, Israel ➢ Zhubei City, Taiwan ➢ The Dalles (OR), United States of ➢ Zurich, Switzerland America

The ISMS is centrally managed out of the Google LLC headquarters in Mountain View, California, United States of America. The ISMS mentioned in the above scope is restricted as defined in the ‘Google Cloud Services Information Security Management System (ISMS) Implementation Manual’ (formal ISMS location listing document), reviewed on February 24, 2020, by the Director, Engineering Compliance.

This scope is only valid in connection with certificate 2012-001b.

Page 6 of 6 Digital version