Excellent article by Eran Feigenbaum, Director of Security, Google Apps
To make it easier for everyone to verify Google's security, Google are now publishing their updated ISO 27001 certificate and new SOC3 audit report for the first time, on Google Enterprise security page.
