# Physical Security Policy

Last updated: October 22, 2026

Summerbase ApS has no data centers of its own; physical security of production is inherited from Google Cloud, and the company protects its office and laptops.

## Scope

Google Cloud data centers (inherited controls), any company office, remote work locations.

## Policy

1. **Data centers.** Production runs only in Google Cloud data centers. Google's physical controls are covered by its SOC 2 Type II and ISO 27001 reports, which the Security Officer downloads and reviews yearly, including the complementary user entity controls (Third-Party Management Policy).
2. **Office.** Any company office is locked outside working hours, with access limited to personnel and escorted visitors. In a shared or coworking space, the provider controls building access and company equipment is not left unattended.
3. **Visitors.** Visitors are accompanied and do not have access to unattended screens or confidential documents.
4. **Remote work.** Personnel working remotely keep devices locked when unattended, avoid viewing confidential data where screens can be seen, and do not leave devices in vehicles.
5. **Paper.** Confidential printed material is kept to a minimum and shredded when no longer needed.
6. **Lost devices.** Lost or stolen devices are reported at once and remotely locked or erased where possible (for example, with Find My Mac), and the user's passwords and sessions are revoked (Incident Response Plan).