Built-in, Automatic Protection

Google’s advanced built-in security is designed to automatically protect you and your data from a wide range of threats. We designed the security of our infrastructure in layers that build upon one another, from the physical security of data centers to the security protections of our hardware and software to the processes we use to support operational security. This layered protection creates a strong security foundation for everything we do.

Advanced Security at our core

Physical security to protect data integrity

From custom-designed data centers to undersea fiber cables that transfer data between continents, we operate one of the world’s most secure and reliable cloud infrastructures. It’s continuously monitored to protect your data and make it available. In the event of a disruption, platform services can be automatically and instantly shifted from one facility to another so that they can continue without interruption.

View our data center locations

Custom hardware with security at its core

Security starts in our hardware. We created processes to help ensure the security of our hardware, including vetting the vendors we work with, designing custom chips, and taking measures to identify and authenticate legitimate Google devices. This foundation allows us to deliver security at every level.

Encryption to keep data private and protected

Encryption brings an even higher level of security and privacy to our services. As the data you create moves between your device, Google services, and our data centers, it is protected by multiple layers of security technology like HTTPS and Transport Layer Security.

HTTPS

Advanced Protection Program

Google’s strongest security, for those who need it most. The Advanced Protection Program safeguards the personal Google Accounts of those at higher risk of targeted online attacks – like journalists, activists, business leaders, and political campaign teams. The program provides comprehensive account security against a wide range of threats and continuously evolves to add new protections.

Learn more

Continous Detection & Prevention

Processes for secure operations

We use security monitoring to protect users from malware

We constantly monitor our applications and deploy patches through automated network analysis and proprietary technology. This lets us detect and respond to threats to protect products from spam, malware, viruses, and other forms of malicious code.

We actively scan to find vulnerabilities

We scan for software vulnerabilities, using a combination of commercially available and purpose-built in-house tools, intensive automated and manual penetration testing, quality assurance processes, software security reviews, and external audits.

We design with security in mind

Our security and privacy experts work with development teams, reviewing code and ensuring products utilize strong security protections.

Strong controls to limit access to trusted personnel

We limit access to your business data to Google personnel who need it to do their jobs; for example, when a customer service agent assists you in managing your data. Strong access controls are enforced by organizational and technical safeguards. And when we work with third parties, like customer support vendors, to provide Google services, we conduct an assessment to ensure they provide the appropriate level of security and privacy needed to receive access to your business data.

Incident management to resolve threats quickly

Our security team works 24/7 to quickly detect, resolve, and notify the appropriate individuals of security incidents. Our security incident management program is structured around industry best practices and tailored into our own "Incident Management at Google (IMAG)" program, which is built around the unique aspects of Google and its infrastructure. We also test our incident response plans regularly, so that we always remain prepared.