Certificate

Certificate number: 2012-001b Certified by EY CertifyPoint since: May 11, 2012

Based on certification examination in conformity with defined requirements in ISO/IEC 17021-1:2015 and ISO/IEC 27006:2015, the Information Security Management System as defined and implemented by

Google LLC*

located in Mountain View, California, United States of America is compliant with the requirements as stated in the standard: ISO/IEC 27001:2013 Issue date of certificate: April 13, 2018 Re-issue date of certificate: December 18, 2018 Expiration date of certificate: April 13, 2021 Last certification cycle expiration date: April 14, 2018

EY CertifyPoint will, according to the certification agreement dated February 22, 2016, perform surveillance audits and acknowledge the certificate until the expiration date noted above.

*The certification is applicable for the assets, services and locations as described in the scoping section on the back of this certificate, with regard to the specific requirements for information security as stated in the Statement of Applicability, v1.2 dated October 4, 2018.

J. Sehgal | Director, EY CertifyPoint

This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, headquartered at Antonio Vivaldistraat 150, 1083 HP Amsterdam, the Netherlands. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form of assurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/regulatory obligations. All right reserved. © Copyright

Page 1 of 5 Digital version

Google LLC

Scope for certificate 2012-001b

The scope of this ISO/IEC 27001:2013 certification is bounded by the following product and its offerings as listed below, along with the data contained or collected by those offerings.

Google Cloud Platform  App Engine  Cloud Router  BigQuery  Cloud SDK  BigQuery Data Transfer Service  Cloud Security Scanner  Cloud Armor  Cloud Shell  Cloud AutoML Natural Language  Cloud Source Repositories  Cloud AutoML Translation  Cloud Spanner  Cloud AutoML Vision  Cloud Speech-to-Text  Cloud  Cloud SQL  Cloud Billing API   Cloud Build  Cloud Storage Transfer Service  Cloud CDN  Cloud Talent Solution  Cloud Console  Cloud Text-to-Speech  Cloud Console Mobile App  Cloud Translation API  Cloud Dataflow  Cloud Video Intelligence API  Cloud Datalab  Cloud Vision API  Cloud Dataproc  Cloud VPN  Cloud Datastore  Compute Engine  Cloud Deployment Manager  Container Registry  Cloud DNS  Data Loss Prevention API  Cloud Endpoints  Enterprise Edition  Cloud Firestore  GCP Marketplace  Cloud Functions  Genomics  Cloud Healthcare API  Google Service Control  Cloud HSM  Google Service Management  Cloud Identity & Access  Engine Management   Cloud Identity-Aware Proxy  Persistent Disk  Cloud Interconnect  Service Consumer Management  Cloud IoT Core API  Cloud Key Management Service  Stackdriver Debugger  Cloud Load Balancing  Stackdriver Error Reporting  Cloud Engine  Stackdriver Logging  Cloud Memorystore  Stackdriver Profiler  Cloud Natural Language API  Stackdriver Trace  Cloud Pub/Sub  Transfer Appliance  Cloud Resource Manager  (VPC)

This scope (edition: December 18, 2018) is only valid in connection with certificate 2012-001b.

Page 2 of 5 Digital version

Google LLC

Scope for certificate 2012-001b

The following locations are in scope:

Data Centers:  Atlanta (1) (GA), United States of  Moncks Corner (SC), United America States of America  Changhua, Taiwan  Pryor Creek (OK), United States  Council Bluffs (1) (IA), United States of America of America  Quilicura, Santiago, Chile  Council Bluffs (2) (IA), United States  Wenya, Singapore of America  Koto-ku, Tokyo, Japan  The Dalles (1) (OR), United States of  Ashburn (VA), United States of America America  The Dalles (2) (OR), United States of  London, United Kingdom America  Frankfurt, Hesse, Germany  Dublin, Ireland  Sydney, NSW, Australia  Eemshaven, Groningen, the  Montreal, Quebec, Canada Netherlands  Osasco, Brazil  Ghlin, Hainaut, Belgium  Mumbai, India  Hamina, Finland  Los Angeles (CA), United States  Lenoir (NC), United States of America

This scope (edition: December 18, 2018) is only valid in connection with certificate 2012-001b.

Page 3 of 5 Digital version

Google LLC

Scope for certificate 2012-001b

Offices:  Mountain View (CA), United States of  Beverly Hills (CA), United States of America America  Sunnyvale (CA), United States of  Taipei, Taiwan America  Montreal, Canada  Irvine (CA), United States of America  Mumbai, India  Boulder (CO), United States of  Prague, Czech Republic America  Melbourne, Australia  New York (NY), United States of  Wroclaw, Poland America  Istanbul, Turkey  Kirkland (WA), United States of  Seoul, South Korea America  Ann Arbor (MI) United States of  Seattle (WA), United States of America America  Portland (OR),United States of  Sydney, Australia America  Hyderabad, India  Sao Paulo, Brazil  Bengaluru, India  Thornton (CO), United States of  Tokyo, Japan America  Zurich, Switzerland  Chapel Hill (NC),United States of  London, United Kingdom America  Los Angeles (CA), United States of  Reston (VA), United States of America America  Playa Vista (CA), United States of  Shanghai, China America  Manila, Philippines  Washington DC, United States of  Gurgaon, India America  San Bruno (CA), United States of  Atlanta (GA), United States of America America  Madison (WI), United States of  Hong Kong, Hong Kong America  Nairobi, Kenya  Singapore, Singapore  Mexico City, Mexico  Tel Aviv, Israel  Toronto, Canada  Pittsburgh (PA), United States of  Hamburg, Germany America  Lenoir (NC), United States of America  Kitchener, Canada  Lithia Springs (GA), United States of  Munich, Germany America  Palo Alto (CA), United States of  Kansas City (MO), United States of America America  Chicago (IL), United States of America  Nashville (TN), United States of  Beijing, China America  Paris, France  Cambridge (MA), United States of  Austin (TX), United States of America America  Warsaw, Poland  Dublin, Ireland

This scope (edition: December 18, 2018) is only valid in connection with certificate 2012-001b.

Page 4 of 5 Digital version

Google LLC

Scope for certificate 2012-001b

Offices (continued) :  Berlin, Germany  Stockholm, Sweden  Buenos Aires, Argentina  Lagos, Nigeria  Milan, Italy  San Francisco (CA), United States of  Dubai, United Arab Emirates America  Moscow, Russia  San Diego (CA), United States of  The Dalles (OR), United States of America America  Auckland, New Zealand  Amsterdam, the Netherlands  Budapest, Hungary  Madrid, Spain  Changhua, Taiwan  Moncks Corner (SC), Unites States of  Frankfurt, Germany America  Ghlin Boudodur, Belgium  Addison (TX), United States of  Hamina, Finland America  New Taipei City, Taiwan

The Information Security Management System (ISMS) is centrally managed out of the Google LLC headquarters in Mountain View, California, United States of America. The ISMS mentioned in the above scope is restricted as defined in the ‘Google Cloud Services Information Security Management System (ISMS) Implementation Manual’ (formal ISMS location listing document), version 1.1, signed on September 25, 2018, by the Director, Engineering Compliance.

This scope (edition: December 18, 2018) is only valid in connection with certificate 2012-001b.

Page 5 of 5 Digital version