General information about security in GCP can be found in Google Security Whitepaper.
To dive deeper into the infrastructure design, take a look at Google infrastructure security design document.

Google also announced several additional options when it comes to security checks. One of them is Cloud Security Command Center. It allows you to discover your data, its location or how firewalls rules are configured. The tool runs discovery scans so you can view asset history and understand exactly what changed in your environment and take actions on unauthorized modifications.
​

Google conducts numerous independent checks of security, compliance and privacy on regular basis.

Information on standards, regulations and certifications can be found here.

Other useful links:
​FedRAMP Compliance

All your data is encrypted by default on the server side before it is written to disk at no charge.
​