Security and trust center evidence
Google LLC is a global technology
Summary
Google has 5 registry-verified rows and 1 third-party reported row in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: CSA STAR Level 2 attestation on the registry, which is built on a SOC 2 examination. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.
Reviewer brief
Google is listed on the CSA STAR registry as of 26 Oct 2026 with a Level 2 attestation built on a SOC 2 examination. Google is listed in the FedRAMP registry as of 02 Nov 2026, with Authorized status granted on 28 Oct 2021 and audited by Coalfire Systems, Inc. Google is listed on the Visa Global Registry as of 02 Nov 2026, showing PCI DSS validation through 31 Mar 2027, originally issued 29 Oct 2008. Google is listed in the EU-US Data Privacy Framework registry as of 02 Nov 2026, with active EU-US and UK Extension Certifications issued 21 Jan 2025, expiring 12 Jan 2027. Google is listed in the DORA critical ICT third-party provider registry as of 02 Nov 2026, designated as Google Cloud EMEA Limited on 18 Nov 2025.
- FedRAMP Authorized (issued 28 Oct 2021, audited by Coalfire Systems, Inc.) - listed in FedRAMP registry as of 02 Nov 2026
- PCI DSS validated through 31 Mar 2027 - listed on Visa Global Registry as of 02 Nov 2026
- DORA critical ICT third-party provider designation (18 Nov 2025) - listed as of 02 Nov 2026
Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 3 Nov 2026; it is regenerated whenever a row changes.
Among cloud and hosting vendors
5verified rows
Category median 0, across 145 indexed cloud and hosting vendors. Google has more verified rows than 99 percent of them.
advertisingcloud-servicesoperating-systemssearch
Compare with similar vendors
Pick your own comparisonCompliance grid
SOC 2ReportedCSA STAR Level 2 attestation on the registry, which is built on a SOC 2 examination
as of 26 Oct 20266 sources
FedRAMPVerifiedFedRAMP Authorized
as of 2 Nov 202647 sources · Coalfire Systems, Inc.
PCI DSSVerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-03-31
as of 2 Nov 20263 sources · Foregenix Ltd.
CSA STARVerifiedSTAR Level 2 attestation, Trusted Cloud Provider
as of 26 Oct 20266 sources
EU-US Data Privacy FrameworkVerifiedActive: EU-US Certification, UK Extension Certification
as of 2 Nov 20262 sources
DORA critical ICT provider designationVerifiedDesignated critical ICT third-party provider under DORA Article 31 as Google Cloud EMEA Limited (ESAs list of 18 November 2025)
as of 2 Nov 20261 source
Legal artefacts
No DPA, BAA or subprocessor list has been captured from a public page yet. Registry rows above do not depend on this.
Subprocessors
No subprocessor list captured yet.
Change history
- 2 Nov 2026FedRAMP auditor changedAuditor changed from Federal Risk and Authorization Management Program to Coalfire Systems, Inc..
- 30 Oct 2026FedRAMP auditor changedAuditor changed from Coalfire Systems, Inc. to Federal Risk and Authorization Management Program.
- 26 Oct 2026FedRAMP auditor changedAuditor changed from Federal Risk and Authorization Management Program to Coalfire Systems, Inc..
- 26 Oct 2026PCI DSS renewedExpiry moved from 2026-11-30 to 2027-03-31.
- 26 Oct 2026PCI DSS auditor changedAuditor changed from A-LIGN Compliance and Security, Inc., dba A-LIGN to Foregenix Ltd..
- 20 Oct 2026FedRAMP auditor changedAuditor changed from Coalfire Systems, Inc. to Federal Risk and Authorization Management Program.
- 19 Oct 2026PCI DSS auditor changedAuditor changed from Compliance Control Ltd. to A-LIGN Compliance and Security, Inc., dba A-LIGN.
- 14 Oct 2026FedRAMP auditor changedAuditor changed from Federal Risk and Authorization Management Program to Coalfire Systems, Inc..
- 12 Oct 2026PCI DSS renewedExpiry moved from 2027-02-28 to 2027-06-30.
- 12 Oct 2026PCI DSS auditor changedAuditor changed from Deiteriy Company Ltd. to Compliance Control Ltd..
Similar vendors with evidence
Related by product tags and the Cloud and hosting category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.
MacStadium
Cloud and hosting
As the industry-leading Mac private cloud and software-as-a-service provider enabling macOS workloads, MacStadium has been solely focused
Arcustech
Cloud and hosting
Developer-focused hosting for Craft CMS and PHP with managed VPS solutions and predictable, reliable self-managed VPS options on modern
One More Cloud
Cloud and hosting
Bonsai keeps your search evergreen with expert deployment, ongoing maintenance, and maximum data security for Elasticsearch or
Prominic.NET
Cloud and hosting
Prominic.NET is a cloud hosting provider focused on privacy, security, and expert management of top technology
Evidence against regulations
All regulations for GoogleHow much of each regulation’s vendor requirements Google’s public evidence reaches.
Reviewing a vendor on public evidence
All articlesWhat Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read