title: Is Google Cloud Storage PCI compliant?
body: <p>Here is the <a href="https://cloud.google.com/files/GCP_Client_Facing_Responsibility_Matrix_PCI_2018.pdf" rel="nofollow noreferrer">Google Cloud Platform: Customer Responsibility Matrix</a>. This document basically goes through all of the PCI DSS requirements and explains what is done by GCP and what is supposed to be done by the customers.</p>
  
  <p><a href="https://cloud.google.com/security/compliance/pci-dss/" rel="nofollow noreferrer">This</a> document states that Google Cloud Storage is in scope for PCI DSS.</p>
  
  <p><a href="https://cloud.google.com/solutions/pci-dss-compliance-in-gcp#cloud_storage" rel="nofollow noreferrer">This</a> GCP link states that "<strong><em>Requirement 3.4 stipulates that a PAN must be unreadable anywhere it is stored. While Google automatically offers encryption at rest, it doesn't automatically perform the one-way hashes, truncation, or tokenization that the rules also require.</em></strong>”</p>
  
  <p>However, I am not able to find proof that explicitly says that Google Cloud storage is PCI compliant as it is a service from a cloud provider.</p>
  
  <p><br> Is there an official document which claims Google Cloud Storage to be PCI compliant as a service? </p>
  
  <p>A document that talks about how GCP achieved PCI DSS compliance for google cloud storage rather than how to fulfill the requirements for the customer's set-up?</p>