Search advertising may be Google’s true business (you didn’t think it was search, did you?), but keeping its information secure might be what some would call job one.

Google would like you to think of four words in association with their ongoing security efforts: philosophy, technology, process, and people.

On the official Google blog, Douglas Merrill, VP of engineering, said the company spends a lot of time thinking about security, as it does about new products.

The process side includes auditing, which should be no surprise. Google is a publicly traded company, and the ongoing specter of Sarbanes-Oxley compliance hangs over them as it does other public firms. They also audit for SAS 70, Payment Card Industry (PCI) compliance, and other areas.

Google’s work on the security side has not always been foolproof. Some of their products suffered from the odd flaw, like the time the official Google blog itself was compromised with a fake post inserted by a third party.

Unlike some of the more egregious incidents like the TJX scandal, Google has not experienced the kind of massive breach exposing hundreds or thousands of personally identifiable bits of information. With continued diligence and some good fortune, there’s every reason to think they can maintain the control they have over their data today.