SOC 2

The core Google Cloud and Google Workspace SOC 2 Type II reports are issued semi-annually and can be downloaded via the Compliance Reports Manager . The coverage periods and issuance dates for these reports are:

• First half of the year 
• Coverage period: May 1 - April 30
• Estimated issuance: mid-June
• Second half of the year 
• Coverage period: November 1 - October 31
• Estimated issuance: mid-December

We issue separate SOC 2 Type II reports for a small subset of Google Cloud products, including AppSheet, Backup and Disaster Recovery, Google Cloud VMware Engine, Bare Metal Solution, Apigee Edge, Actifio Heritage, StratoZone, Google Security Operations SOAR, Mandiant, and Looker (Google Cloud core). These reports are issued annually and customers can obtain these reports by contacting sales or support .

Bridge letters are attestations made by the management of the service provider, in this case, Google Cloud, and are intended to “bridge” the gap from the end date of the SOC report to the customer’s period end date. Bridge letters summarize material changes or issues identified within the internal control environment beyond the period end date of the most recent SOC report. Bridge letters are available for SOC 1 and SOC 2 reports.

Google Cloud creates monthly bridge letters with each letter designed to cover the period since the most recent SOC report. For example, Google Cloud issues a bridge letter in early January to cover the look-back period of November 1 to December 31, which extends the coverage period of the previously issued SOC report with a period end date of October 31.

SOC bridge letters for the core Google Cloud and Google Workspace SOC 2 reports are made available on Compliance Reports Manager for the periods ending March 31, June 30, September 30, and December 31 and can be downloaded directly. If a bridge letter covering a different period end date or product scope is required, please contact sales or support .