Additional Terms: Storage (GCP — Cloud Storage)

Effective Date: April 16, 2026
Cloud Provider: Google Cloud Platform
GCP Service: Cloud Storage (GCS)
Document ID: QUOME-LEGAL-STORAGE-GCP-001

These Additional Terms govern your use of the Quome Storage service ("Storage") when provisioned on Google Cloud Platform. These terms supplement the Terms of Service.

1. Service Description

Storage enables you to provision and manage object storage buckets on Google Cloud Storage within your GCP project under the BYOSA model. Quome handles bucket provisioning, access control, HMAC credential management for S3-compatible access, and credential storage on your behalf.

2. Infrastructure Ownership

2.1 Customer-Owned Resources

• GCS buckets and all stored objects
• Bucket IAM policies and access controls
• Per-bucket service accounts
• HMAC keys for S3-compatible access
• Credentials stored in Secret Manager

2.2 Quome-Managed Configuration

• Bucket provisioning (name, region, storage class)
• Service account creation and IAM binding
• HMAC key lifecycle management (creation, rotation)
• Credential storage in Secret Manager
• Presigned URL generation (when enabled)

3. Customer Responsibilities

3.1 Stored Content

You are solely responsible for all objects stored in your GCS buckets, including ensuring that content complies with Applicable Law and does not infringe third-party rights.

3.2 Access Control

You are responsible for:

(a) Configuring appropriate bucket-level access controls;

(b) Not enabling public access to buckets containing sensitive or regulated data;

(c) Rotating credentials periodically through the Quome platform;

(d) Managing presigned URL expiration times appropriately for your security requirements.

3.3 Data Classification

If your buckets store regulated data, you must:

(a) Enable encryption at rest using CMEK;

(b) Disable public bucket access;

(c) Configure appropriate retention policies;

(d) Maintain audit logging for all bucket access.

4. HMAC Key Management

Quome manages HMAC keys for S3-compatible access to your GCS buckets. Key details:

(a) One HMAC key is shared across all buckets for your organization's storage service account;

(b) The HMAC secret is stored in Secret Manager within your GCP project;

(c) GCP limits each service account to 5 HMAC keys — Quome manages this limit automatically by reusing existing keys and cleaning up inactive ones;

(d) You may rotate HMAC keys through the Quome platform at any time.

5. Service Limits

Storage is subject to Google Cloud Storage quotas, limits, and pricing. GCS pricing (storage, operations, egress) is billed directly by Google Cloud. Key limits:

6. Data Handling

6.1 Object Content

All stored objects reside exclusively in your GCP project. Quome's control plane never reads or processes the content of stored objects.

6.2 Metadata

Quome stores bucket metadata in its control plane: bucket name, GCS bucket name, region, storage class, status, and credential secret reference. Object-level metadata is not stored in the control plane.

7. Termination Effects

Upon termination:

(a) GCS buckets and all stored objects remain in your GCP project;

(b) Service accounts and HMAC keys remain functional;

(c) You retain full control via the GCP Console or gsutil.

Cloud Provider Reference

AWS (S3) and Azure (Blob Storage) Additional Terms will be published when those providers reach general availability.