Is cloud.google.com safe to use as a vendor?

cloud.google.com scored 92/100 on LynxRadar's security posture assessment. The domain meets baseline security requirements. 10 checks passed, 4 warnings, 1 critical issues across 16 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does cloud.google.com use?

cloud.google.com uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does cloud.google.com have DMARC configured?

Yes. cloud.google.com's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); DMARC pct=100 — policy applies to all mail; Aggregate reports (rua) configured; SPF soft-fail (~all) configured; SPF DNS lookup count: 1/10 (within limit); DKIM keys published (custom selector names).

Does cloud.google.com have SPF configured?

Yes. SPF record: v=spf1 include:_spf.google.com ~all

Does cloud.google.com have security headers configured?

cloud.google.com has 4 of 5 recommended security headers. Present: CSP, X-Content-Type-Options, X-Frame-Options, Permissions-Policy. Missing: Referrer-Policy.

Does cloud.google.com use HSTS?

Yes. HSTS enabled: max-age=31536000s (365 days). Missing includeSubDomains — subdomains not covered. Missing preload directive.

Has cloud.google.com been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

Does cloud.google.com have known CVE vulnerabilities?

Detected technologies: ESF. No version information exposed — CVE matching not possible (this is good practice).

Is cloud.google.com's SSL certificate valid?

Yes. Strengths: Certificate valid, 51 days remaining; Issued by Google Trust Services; 3970 certificates logged in CT; Certificates from 3 CAs: Google Inc, Google Trust Services, Google Trust Services LLC. Note: Wildcard certificate in use (*.domain) — covers all subdomains. Common practice; worth noting that compromise would affect all subdomains.

cloud.google.com Security Report — Grade A- (92/100)

Q: Does cloud.google.com have DNSSEC enabled?

No. Strengths: 4 nameservers configured (ns2.google.com, ns4.google.com, ns1.google.com, ns3.google.com); SOA record present and MNAME consistent with NS set; 1 MX record(s) present; Zone transfers properly restricted on all nameservers; Address records present: 1 A record(s), 4 AAAA record(s). Issues: All nameservers are from a single provider (google.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

A-

Trust rating

Excellent · 92/100

Procurement snapshot

0 critical findings identified — these point to architectural gaps, not just configuration tweaks.

Strengths

MX Records & Mail Provider

TLS Configuration

TLS Protocol Support

MTA-STS & TLS Reporting

Questions to ask

Confirm DNSSEC rollout timeline

Estimated remediation effort: 1–3 days

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned November 09, 2026

Score

100 75 50 25 0

A-

cloud.google.com

92/100

Compliance & Certifications

Not yet verified

SOC 2 Type II

Audit report not on file

3rd party · AICPA

ISO 27001

Certificate not on file

3rd party · accredited body

GDPR

DPA not on file

Self-reported

CCPA

Self-reported

Incident History

No public breaches on record

Security Posture

5 items need attention

10 passed

Add missing cookie security settings

Cookie Security

1–2 hours High

This makes it meaningfully easier for an attacker to hijack authenticated customer sessions, increasing account-takeover risk. On cloud.google.com, most cookies are missing key protections: 1 cookie(s) can be sent over an unencrypted connection (missing the "Secure" flag); 1 cookie(s) don't restrict cross-site requests (missing "SameSite").

OWASP ASVS3.4

Session cookies use Secure, HttpOnly, and SameSite attributes

How to fix this

1Add Secure to every cookie your site sets — this is usually one line in your app's session/cookie config, not a DNS or hosting setting.

2Add SameSite=Lax (or Strict for sensitive cookies) to every cookie.

3This needs a developer — it's a one-line change per cookie in your website's code, not something changeable from a hosting dashboard.

4Re-scan afterward to confirm all three flags are now set.

Cookie security guide

Report unlocked.

View all 10 passed checks

MX Records & Mail Provider

TLS Configuration

TLS Protocol Support

MTA-STS & TLS Reporting

HSTS Header

DMARC / Email Security

Known Breaches

Subprocessors & Tech Stack

CVE Exposure

Certificate Hygiene

Couldn't check: Malware / Phishing Blocklist — the check didn't complete (the site blocked or timed out our scanner, or a data source was unavailable), so this isn't counted in the score.

Company Signals

Operational risk

Last funding

Employees

Trust Resources

Claim profile →

Trust Center

Not detected

DPA (Data Processing Agreement)

Subprocessors List

Similar companies

Appears in

Vendors graded A

390 companies · LynxRadar ranking

Top 10% by security score

297 companies · LynxRadar ranking

Blocking Issues

Fail

Strengths: 1 cookie(s) analyzed; All cookies have HttpOnly flag. Issues: 1/1 cookie(s) missing Secure flag (NID); 1/1 cookie(s) missing SameSite attribute (NID).

Likelihood: ★★★★☆

Impact: ★★★★☆

Medium Priority

Not enabled

Strengths: 4 nameservers configured (ns2.google.com, ns4.google.com, ns1.google.com, ns3.google.com); SOA record present and MNAME consistent with NS set; 1 MX record(s) present; Zone transfers properly restricted on all nameservers; Address records present: 1 A record(s), 4 AAAA record(s). Issues: All nameservers are from a single provider (google.com) — a provider outage takes down the domain; DNSSEC not configured — DNS responses can be spoofed or tampered with in transit (DNS cache poisoning).

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Best Practice

Warn

Strengths: CAA records configured at google.com (1 record(s)); Authorised CAs: pki.goog. Issues: No iodef record — CA violations won't be reported to the domain owner.

Likelihood: ★☆☆☆☆

Impact: ★☆☆☆☆

4/5 present

Missing: Referrer-Policy

Likelihood: ★★☆☆☆

Impact: ★☆☆☆☆

Warn

No security.txt found. Publishing a security.txt at /.well-known/security.txt is the industry standard (RFC 9116) for vulnerability disclosure policies. Its absence may indicate a less mature security program.

Likelihood: ★☆☆☆☆

Impact: ★☆☆☆☆