Google Maps Platform

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: Google Maps have restrictions for supporting high risk activities and should not be used for (a) emergency response services; (b) autonomous and semi-autonomous vehicle or drone control; (c) vessel navigation; (d) aviation; (e) air traffic control; (f) nuclear facilities operation; (g) precision targeting.
System requirements: Google Maps must be used with a licence

User support

Email or online ticketing support: Email or online ticketing
Support response times: We will process requests within 4 hours during the normal hours of operation. Any requests received outside of the hours of operation will be logged and processed at the beginning of the next business day. Normal hours of operation means customers located in Europe, Middle East and Africa, 9:00 - 17:00 GMT (Greenwich Mean Time) on business days;
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.1 AAA
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Onsite support
Support levels: Google Maps are provided with one level of service .
There are no differentiated support levels available with Google Maps.
Access is provided to the technical support service.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Google Maps supports the development community with instructional online documentation and libraries of example code.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: Google Maps does not retain any data from the outset and and once a contract is completed there is no data to return or extract.
End-of-contract process: The Google Maps licence is a simple annual process and upon notification that you do not wish to renew, your service is cancelled at an agreed date and access is disabled.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Google Maps services work the same across desktop and mobile devices.
Service interface: Yes
User support accessibility: WCAG 2.1 AAA
Description of service interface: Web Browser and Mobile - Android and IOS
Accessibility standards: WCAG 2.1 AAA
Accessibility testing: You can use a screen reader, keyboard shortcuts, and other features to make your Google Maps experience more accessible.
https://support.google.com/maps/answer/6396990
API: Yes
What users can and can't do using the API: The Google Maps API offers a suite of read-based web services that enable the development of static or interactive maps embedded into a website or smartphone app. The core mapping APIs are supplemented by a number of additional web services for:
- Street View and high resolution satellite imagery
- Route generation for public transport, biking, driving, and walking directions
- Data on location names, addresses, ratings, reviews, contact information, and atmosphere
Given the wide variety of use cases and solutions that are available from Google Maps that can be combined into web and mobile offerings, please contact Geo.me.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Google Maps customisation is extensive and dependent upon the use case, the richness of the geo data and the extent to which branding guidelines are to be incorporated into the map. Customisation would be managed by the development team.

Scaling

Independence of resources: Prior to service commencement a full estimation of service usage is determined. This information is provided to the Google Maps platform team at order entry and your account is set-up for that level of throughput.

Underpinning this is the scale at which Google have built out the Google Maps platform worldwide.
Supporting for example:-
i) Over 1 billion monthly Google Maps users,
ii) Over 1 million websites & Apps use Google Maps every day,
iii) Over 1 Billion Kilometres in Public transit results daily.

Analytics

Service usage metrics: Yes
Metrics types: Daily service usage metrics are provided by means of an account based online dashboard.

These show the amount of services used per API with supporting graphics.
Reporting types: API access

Regular reports

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Google Maps

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Google hard drives leverage technologies like FDE (full disk encryption) and drive locking. https://cloud.google.com/security/encryption-at-rest
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: There are two parts to this

1)The Google Maps API's do not retain or store data. The APIs are driven by the customer Geodata which they retain.

2) If you are using the maps for analytic or reporting purposes you can output certain sets of results
Data export formats: CSV
Data import formats: CSV

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: SLAs are service specific:

https://cloud.google.com/maps-platform/terms/sla/
Approach to resilience: Google operates a global network of data centers to reduce risks from geographical disruptions. The link
below includes the locations of our data centers:
http://www.google.com/about/datacenters/inside/locations/
Google does not depend on failover to other providers and builds redundancy and failover into its own
global infrastructure.
Google performs annual testing of its business continuity plans to simulate disaster scenarios that
simulate catastrophic events that may disrupt Google operations.https://services.google.com/fh/files/misc/sep_2021_caiq_self_assessment.pdf
Outage reporting: Google maintains a dashboard with service availability and service issues here:

https://developers.google.com/maps/support/contact-support
https://status.cloud.google.com/maps-platform/

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Google Cloud Identity & Access Management (IAM) lets administrators authorize who can take action on
specific resources, giving you full control and visibility to manage cloud resources centrally. For
established enterprises with complex organizational structures, hundreds of workgroups and potentially
many more projects, Cloud IAM provides a unified view into security policy across your entire
organization, with built-in auditing to ease compliance processes. IAM access policies are defined at the
project level using granular controls of users and groups or using ACLs.
https://cloud.google.com/iam/
https://cloud.google.com/compute/docs/access/
For further information see;
https://services.google.com/fh/files/misc/sep_2021_caiq_self_assessment.pdf
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Ernst & Young CertifyPoint B.V.
ISO/IEC 27001 accreditation date: 30/11/2022
What the ISO/IEC 27001 doesn’t cover: See certificate for full list of products covered, anything not listed is not covered.
https://services.google.com/fh/files/misc/iso_27001_certificate.pdf
https://cloud.google.com/security/compliance/iso-27001/?hl=ro
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 01/06/2023
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: For further information see;
https://cloud.google.com/security/compliance/compliance-reports-manager
PCI certification: Yes
Who accredited the PCI DSS certification: Reviewed by an independent Qualified Security Assessor
PCI DSS accreditation date: 01/05/2023
What the PCI DSS doesn’t cover: The validation enables PCI Level 1 merchants to use Google Cloud Platform for their processing services.
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: SSAE16 / ISAE 3402 Type II

SOC 1

SOC 2

SOC 3 public audit report

ISO 27001

ISO 27017

ISO 27018

HIPAA

CSA STAR

EU-US Privacy Shield Framework

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: CSA CCM version 3.0

ISO/IEC 27001

Other
Other security governance standards: https://cloud.google.com/security/compliance
SSAE16 / ISAE 3402 Type II:
SOC 1
SOC 2
SOC 3 public audit report
ISO 27001
ISO 27017
ISO 27018
FedRamp ATO for Google App Engine
PCI DSS v3.1
HIPAA
CSA STAR
EU Data Protection Directive
EU-U.S. Privacy Shield Framework
Information security policies and processes: https://cloud.google.com/security/compliance
Custom, ISO27001, ISO27017, ISO270018

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: In Google production environments, software updates are manually vetted to ensure the stability of the system. Changes are then tested and cautiously rolled out to systems. The details vary somewhat depending on the service being considered, but all development work is separated from the operation systems, testing occurs in a multi-staged fashion in both environments and in dedicated test settings. We can share, under NDA, the SOC2 audit report (based on standards from the International Auditing and Assurance Standards Board), which describes the change management process. Additionally, changes to code go through a process of code review involving additional engineer(s).
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Google administrates a vulnerability management process that actively scans for security threats using a combination of commercially available and purpose-built in-house tools, intensive-automated and manual penetration efforts, quality assurance processes, software security reviews and external audits. The vulnerability management team is responsible for tracking and following up on vulnerabilities. Once a vulnerability requiring remediation has been identified, it is logged, prioritized according to severity, and assigned an owner. The vulnerability management team tracks and follows up frequently until remediated. Google also maintains relationships with members of the security research community to track issues in Google services and open-source tools.
https://cloud.google.com/security/whitepaper
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Google’s security monitoring program is focused on information gathered from internal network traffic, employee actions on systems and outside knowledge of vulnerabilities. At many points across our global network, internal traffic is inspected for suspicious behavior, such as the presence of traffic that might indicate botnet connections. Network analysis is supplemented by examining system logs to identify unusual behavior, such as attempted access of customer data. They actively review inbound security reports and monitor public mailing lists, blog posts, and wikis. Automated network analysis helps determine when an unknown threat may exist and escalates to Google security staff.
https://cloud.google.com/security/whitepaper
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: We have a rigorous incident management process for security events that may affect the confidentiality, integrity, or availability of systems or data. This process specifies courses of action, procedures for notification, escalation, mitigation, and documentation. Google’s security incident management program is structured around the NIST guidance on handling incidents (NIST SP 800–61). Key staff are trained in forensics and handling evidence in preparation for an event, including the use of third-party and proprietary tools. Testing of incident response plans is performed for key areas, such as systems that store sensitive customer information.
https://cloud.google.com/security/whitepaper

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Wellbeing

Fighting climate change

Fighting climate change: By providing information on green transportation options like walking, biking and public transit, Google Maps can influence more environmentally-friendly choices. Features like eco-friendly routing optimize routes for lower fuel consumption.

Covid-19 recovery

COVID-19 recovery: Google Maps can support social distancing and remote working by enabling services like roadside pickup and delivery tracking. It can also help people find and access COVID-19 testing and vaccination sites.

Tackling economic inequality

Tackling economic inequality: Google Maps APIs and location-based features can help entrepreneurs and small businesses grow by reaching more customers online. For example, adding a store locator or delivery zones can boost sales.

Wellbeing

Wellbeing: Google Maps can improve community wellbeing by helping people discover local parks, health services, and community resources. The platform also powers many health and fitness apps that support physical and mental wellness.

Pricing

Price: £0.00 a unit
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: The first £160 ($200) worth of Google Maps Platform consumption in each calendar month is free. This allowance can be used to facilitate a free service trial. All component services are included and there is no time limitation.

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Google Maps Platform

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents