Certificate

Certificate number: 2016-006a

Certified by EY CertifyPoint since: April 29, 2016

Based on certification examination in conformity with defined requirements in ISO/IEC

17021-1:2015 and ISO/IEC 27006:2015, the Information Security Management
System as defined and implemented by

Google LLC*
located in Mountain View, California, United States of America is compliant with the
requirements as stated in the standard:

ISO/IEC 27001:2013
Issue date of certificate: April 13, 2018
Re-issue date of certificate: April 15, 2019
Expiration date of certificate: April 13, 2021
Last certification cycle expiration date: April 28, 2019

EY CertifyPoint will, according to the certification agreement dated April 8, 2019,

perform surveillance audits and acknowledge the certificate until the expiration date
noted above.

*The certification is applicable for the assets, services and locations as described in the scoping section
on the back of this certificate, with regard to the specific requirements for information security as stated
in the Statement of Applicability, version 4.5, dated February 26, 2019.

J. Sehgal | Director, EY CertifyPoint

This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, the Netherlands and is governed by the Dutch law. Any dispute relating to this certificate shall be subject to the
exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere to the scope and nature of
certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form of assurance on the
performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All right reserved. © Copyright

Page 1 of 5 Digital version

 Google LLC
Scope for certificate 2016-006a
The scope of this ISO/IEC 27001:2013 certification is bounded by the following product
and its offerings as listed below, along with the data contained or collected by those
offerings.

Ads
➢ Ads Data Hub ➢ Google Data Studio
➢ Audience Partner API (DoubleClick ➢ Google Fonts
Data Platform) ➢ Google Marketing Platform
➢ Authorized Buyers (formerly part of (formerly Google Analytics
DoubleClick AdExchange) 360 Suite)
➢ Campaign Manager (formerly ➢ Google Optimize
DoubleClick Campaign Manager) ➢ Google Surveys
➢ Customer Match ➢ Google Tag Manager
➢ Display and Video 360 (formerly ➢ Optimize 360
DoubleClick Bid Manager) ➢ Sales Lift
➢ Google Ad Manager (formerly ➢ Search Ads 360 (formerly
DoubleClick for Publishers and DoubleClick Search)
DoubleClick AdExchange) ➢ Store Sales (direct upload)
➢ Google Ads Conversion Tracking ➢ Store Sales Automated
➢ Google Analytics ➢ Surveys 360
➢ Google Analytics 360 ➢ Tag Manager 360
➢ Google Attribution

The following locations are in scope:

Data Centers:
➢ Atlanta (1) (GA), United States of ➢ Eemshaven, Groningen, the
America Netherlands
➢ Changhua, Taiwan ➢ Ghlin, Hainaut, Belgium
➢ Council Bluffs (1) (IA), United States ➢ Hamina, Finland
of America ➢ Lenoir (NC), United States of
➢ Council Bluffs (2) (IA), United States America
of America ➢ Moncks Corner (SC), United
➢ The Dalles (1) (OR), United States of States of America
America ➢ Pryor Creek (OK), United States
➢ The Dalles (2) (OR), United States of of America
America ➢ Quilicura, Santiago, Chile
➢ Dublin, Ireland ➢ Wenya, Singapore

This scope (edition: April 15, 2019) is only valid in connection with certificate 2016-006a.

Page 2 of 5 Digital version

 Google LLC
Scope for certificate 2016-006a

Offices:
➢ Aarhus, Denmark ➢ Edmonton, Canada
➢ Addison (TX), United States of ➢ Frankfurt, Germany
America ➢ Goleta (CA), United States of America
➢ Amsterdam, The Netherlands ➢ Gurgaon, India
➢ Ann Arbor (MI), United States of ➢ Haifa, Israel
America ➢ Hamburg, Germany
➢ Athens, Greece ➢ Helsinki, Finland
➢ Atlanta (GA), United States of ➢ Hong Kong, Hong Kong
America ➢ Hyderabad, India
➢ Auckland, New Zealand ➢ Irvine (CA), United States of America
➢ Austin (TX), United States of America ➢ Istanbul, Turkey
➢ Bengaluru, India ➢ Johannesburg, South Africa
➢ Bangkok, Thailand ➢ Kiev, Ukraine
➢ Beijing, China ➢ Kirkland (WA), United States of
➢ Belo Horizonte, Brazil America
➢ Berlin, Germany ➢ Kitchener, Canada
➢ Birmingham (AL), United States of ➢ Krakow, Poland
America ➢ Kuala Lumpur, Malaysia
➢ Bogota, Colombia ➢ Lagos, Nigeria
➢ Bothell (WA), United States of ➢ Lisbon, Portugal
America ➢ Lithia Springs (GA), United States of
➢ Boulder (CO), United States of America
America ➢ Livermore (CA), United States of
➢ Bratislava, Slovakia America
➢ Brussels, Belgium ➢ London, United Kingdom
➢ Bucharest, Romania ➢ Los Angeles (CA), United States of
➢ Budapest, Hungary America
➢ Buenos Aires, Argentina ➢ Madison (WI), United States of
➢ Cambridge (MA), United States of America
America ➢ Madrid, Spain
➢ Cebu City, Philippines ➢ Manchester, United Kingdom
➢ Chapel Hill (NC), United States of ➢ Manila, Philippines
America ➢ Melbourne, Australia
➢ Chicago (IL), United States of America ➢ Mexico City, Mexico
➢ Copenhagen, Denmark ➢ Miami (FL), United States of America
➢ Detroit (MI), United States of America ➢ Milan, Italy
➢ Dubai, UAE ➢ Moncks Corner (SC), United States of
➢ Dublin, Ireland America
➢ Durham (NC), United States of ➢ Montreal, Canada
America ➢ Moscow, Russia

This scope (edition: April 15, 2019) is only valid in connection with certificate 2016-006a.

Page 3 of 5 Digital version

 Google LLC
Scope for certificate 2016-006a

Offices (continued):
➢ Mountain View (CA), United States of ➢ San Jose (CA), United States of
America America
➢ Mumbai, India ➢ Santiago, Chile
➢ Munich, Germany ➢ Sao Paulo, Brazil
➢ Nairobi, Kenya ➢ Seattle (WA), United States of
➢ Nashville (TN), United States of America
America ➢ Seoul, Korea
➢ New Taipei City, Taiwan ➢ Shanghai, China
➢ New York (NY), United States of ➢ Singapore, Singapore
America ➢ South Jakarta, Indonesia
➢ Osaka, Japan ➢ South San Francisco (CA), United
➢ Oslo, Norway States of America
➢ Palo Alto (CA), United States of ➢ Stockholm, Sweden
America ➢ Sunnyvale (CA), United States of
➢ Paris, France America
➢ Pittsburgh (PA), United States of ➢ Sydney, Australia
America ➢ Tainan, Taiwan
➢ Playa Vista (CA), United States of ➢ Taipei, Taiwan
America ➢ Taoyuan, Taiwan
➢ Portland (OR), United States of ➢ Tel Aviv, Israel
America ➢ Thornton (CO), United States of
➢ Prague, Czech Republic America
➢ Redwood City (CA), United States of ➢ Tokyo, Japan
America ➢ Toronto, Canada
➢ Reston (VA), United States of America ➢ Vienna, Austria
➢ Rome, Italy ➢ Vilnius, Lithuania
➢ Salt Lake City, United States of ➢ Warsaw, Poland
America ➢ Washington DC, United States of
➢ San Bruno (CA), United States of America
America ➢ Wroclaw, Poland
➢ San Diego (CA), United States of ➢ Zagreb, Croatia
America ➢ Zhubei City, Taiwan
➢ San Francisco (CA), United States of ➢ Zurich, Switzerland
America

This scope (edition: April 15, 2019) is only valid in connection with certificate 2016-006a.

Page 4 of 5 Digital version

 Google LLC
Scope for certificate 2016-006a

The Information Security Management System (ISMS) is centrally managed out of the
Google LLC headquarters in Mountain View, California, United States of America. The
ISMS mentioned in the above scope is restricted as defined in the ‘Google Information
Security Management System (ISMS) Implementation Manual’ (formal ISMS location listing
document), version 4.3, signed on February 15, 2019, by the Director, Engineering
Compliance.

This scope (edition: April 15, 2019) is only valid in connection with certificate 2016-006a.

Page 5 of 5 Digital version