This suggests they are SOC compliant, among other things, and been audited by an independent accounting firm: https://support.google.com/googlecloud/answer/6056694?hl=en

SOC seems to be the gold standard in terms of what enterprises are asking for, these days. Not that it addresses all the concerns as discussed here, but it does probably start to answer your question.

According to this: https://support.google.com/googlecloud/answer/6056650?hl=en

E&Y does (apparently), and Google is compliant with some ISO standard for software security. See "Does giving Google access to my data create a security risk? How does Google ensure that its employees do not pose a threat?"