In a recently published Infrastructure Security Design Overview, Google explains its six layers of security for the cloud it uses for its own operations and its public cloud services. The company also revealed that it designs custom chips, “including a hardware security chip that is currently being deployed on both servers and peripherals,” that allow it to “securely identify and authenticate legitimate Google devices at the hardware level.” The chip works with cryptographic signatures validated during each boot or update.

According to The Register, all components are “all Google-controlled, built, and hardened,” and Google says it improves security with each new generation of hardware. The overview also divulges that Google “hosts some servers in third-party data centers,” but relies on its own physical security including “independent biometric identification systems, cameras, and metal detectors.”

Google applications “encrypt data before it is written to disk, to make it harder for malicious disk firmware to access data,” says the document, which details the steps taken (including a multi-step cleaning process) before storage devices leave Google’s custody.

The overview describes client security, with its universal second factor authentication and scan of employees’ devices. “We additionally have systems for scanning user-installed apps, downloads, browser extensions, and content browsed from the web for suitability on corp clients,” says Google.

“Being on the corporate LAN is not our primary mechanism for granting access privileges. We instead use application-level access management controls which allow us to expose internal applications to only specific users when they are coming from a correctly managed device and from expected networks and geographic locations.”

Google describes its “automated and manual code review techniques” for finding bugs in developers’ software, and also details “the lengths [it] goes to in its quest to protect source code.” Google’s public cloud, says the document, runs virtual machines in a customized KVM hypervisor and adds it is “the largest submitter of CVEs and security bug fixes for the Linux KVM hypervisor.”

Google also reveals that its cloud “rests on the same security services as the rest of its offerings” and does not “rely on internal network segmentation or firewalling as [its] primary security mechanisms.”