Trust Principles & Compliance

Bundled into the existing Cloud Digital Leader premium course — no separate purchase.

Included in this chapter:

Control	Question it answers	What it governs	Primary Google mechanism
Data residency	Where is my data stored?	Physical/geographic location of data at rest	Resource location policies, region selection
Data sovereignty	Who can access my data?	Control/approval over access, including Google's	Access controls + Access Transparency/Approval; customer-managed/external keys
Operational sovereignty	Can the provider compromise my workload?	Assurance Google personnel cannot compromise workloads	Personnel controls (e.g. via Assured Workloads)
Bundled regulatory regime	How do I enforce all three for a regulation?	Residency + access + personnel together for a compliance regime	Assured Workloads control packages

Cheat sheet

You own your Customer Data; Google is the processor
Google does not use Customer Data for advertising or sell it
Access Transparency logs Google's access to your data; Cloud Audit Logs logs yours
Access Transparency entries record the reason for each access
Google publishes a public Transparency Report on government data requests
Google's compliance is verified by independent third-party audits
Get audit reports and certificates from the Compliance Reports Manager
Google's certifications give a compliant foundation, not blanket workload compliance
Data residency is about where data is stored at rest
Data sovereignty is about who can access data, not where it lives
Residency does not give you sovereignty
Operational sovereignty assures the provider can't compromise your workload
Assured Workloads bundles residency, access, and personnel controls for a regulation
Trust principles are the data view of the shared responsibility model
The Compliance Resource Center is the hub for exploring Google's certifications by industry and region

Unlock with Premium — includes all practice exams and the complete study guide.

Cheat sheet