Do you need Google's CASA assessment?
Gmail for external users needs Google's yearly security assessment (CASA) for your app. We give you the evidence for our part, free on every plan. Some apps do not need it at all. Answer five questions and we will tell you which you are.
Self-assessment
Likely yes: restricted scopes with a server
- Reading or modifying Gmail through a server uses restricted scopes. Google asks for an annual third-party security assessment (CASA) for your OAuth app.
- Self-hosting does not remove this. The assessment is for the OAuth app you register, not for where our code runs.
What to do next
- Budget for the lab: about $499 to $855 for a Tier 2 style scan, and up to about $5,400 for a deeper assessment, per app per year (estimates read Nov 2026, check the lab's current price).
- Use the Readiness Kit for the evidence about our part: security questionnaire mapping, scan configuration and report, deletion evidence, architecture and encryption notes.
- A different path may avoid it: IMAP with app passwords, send-only, or a Workspace Internal app.
A rough guide, calculated in your browser. Nothing is sent anywhere. Google decides, so check its current policy.
What is in the kit
It covers our part only. You still hire your own assessor. Read Google's restricted scope verification policy first.
- 01
Assessment checklist
Our components mapped to the assessment questions, so you only answer for your own code.
- 02
Data-flow and data-inventory templates
Pre-filled for our part, with blanks for yours. Where mail data flows, and where it never goes.
- 03
Evidence index
Every item an assessor asks for, where it lives and who holds it. The ZAP configuration is in the zip; the latest report is attached to each tagged release.
- 04
Data deletion evidence
How DELETE /v1/accounts/{id} revokes the token and removes rows, with the deletion record.
- 05
Encryption notes and architecture
Envelope encryption of tokens at rest, and the components and trust boundaries.
CASA questions
Does self-hosting avoid the Google assessment?
No. The assessment is for the OAuth app you register with Google, not for where our code runs. Self-hosting changes who holds the data, not what Google asks of your app.
Do you resell or pay for the assessment?
No. You hire your own assessor and pay them directly. We never resell an assessment, and we do not run a shared verified Google app.
Which apps never need it?
Send-only apps, apps set to Internal inside your own Workspace organisation, apps in Testing under 100 users, and IMAP or SMTP connections with app passwords. Microsoft 365 has no CASA.
Is the kit available on the free plan?
Yes. It is included on every plan, including Developer.
What is not in the zip?
The ZAP report. CI attaches it to each tagged release next to the same version of the kit; the zip lists where to find it. The kit covers our components only.