CASA Tier 2 Assessment for Gmail Apps, Explained

The short answer: a CASA (Cloud Application Security Assessment) is the independent security review Google requires before an app can use restricted Gmail scopes, the permissions that let an app read or change your mail. Google decides how deep the review goes, an authorized assessor carries it out, and it has to be repeated every year. Premail went through it because it acts on your Gmail inbox: NetSentries completed Premail's CASA Tier 2 assessment on August 7, 2026, with the full application in scope. There is no public report link, so this post explains the process and what it covered.

Which apps need a CASA assessment

Google splits its API permissions (scopes) into tiers of sensitivity. Most Gmail scopes that read message content or modify a mailbox are restricted. According to Google's own help page on the assessment, apps that request restricted scopes must undergo an annual security assessment, and it is the final step of the restricted scope review.

You do not start it yourself. You first complete the rest of Google's verification (app identity, the scopes you request and why, the consent screen, a privacy policy), and Google's Trust and Safety team contacts you when it is time to begin the security assessment.

What the CASA tiers mean

CASA is maintained by the App Defense Alliance and is built on the OWASP Application Security Verification Standard (ASVS), a public catalogue of application security requirements. It is risk based: the more users an app has and the more sensitive the data it touches, the more rigorous the verification.

Google assigns the level, not the developer. Google's page says the level depends on user count, requested scopes, and other app-specific signals, and that the required level can rise in later years if the user base or data handling changes.
Tier 2 is verified by an authorized assessor. The application is scanned with application security testing tools, failures are fixed, and an assessor authorized under CASA verifies the results. The App Defense Alliance's Tier 2 overview notes that the older developer self-scan route is deprecated in favor of lab-verified scanning.

How a Tier 2 assessment runs

The details vary by assessor, but the documented shape is the same:

Google's notification email tells you an assessment is required.
You choose an assessor from the list authorized under CASA and agree the scope.
The application is scanned against the CASA requirements.
Failed checks, reported as CWE weaknesses mapped to CASA requirements, are fixed and re-scanned.
The assessor verifies the results and issues its validation to Google.
Google completes the restricted scope review. Twelve months later, it starts again.

If you already hold industry certifications, Google mentions a CASA accelerator that maps them to CASA requirements and can reduce the checks you need.

How long it takes and what it costs

Google's documentation does not publish a fee or a fixed timeline, so both depend on the assessor you pick and how much remediation the scans turn up. We are not going to quote numbers we cannot source. The practical advice is to get quotes from more than one authorized assessor, and to run the scans against a build you consider finished, because each round of fixes adds time.

What CASA does and does not tell you

CASA is distinct from Google OAuth verification. OAuth verification reviews an app's identity, requested permissions, and consent experience. CASA examines the application's security controls: authentication, data protection, vulnerability management, and secure development practices.

Neither process guarantees that software is risk free. An assessment reflects the scope and point in time its assessor documented, which is why it is annual, and why an app's own day-to-day security practices still matter.

What Premail's assessment covered

Assessor: NetSentries, a third party authorized to assess applications under CASA.
Level: CASA Tier 2, completed August 7, 2026.
Scope: the entire Premail application, not only its Google integration.
Renewal: annual, as Google requires.

How Premail limits Gmail access

Premail needs Gmail access to classify messages and carry out the actions you configure, such as archiving, labeling, or moving mail. The desktop app connects directly to Gmail; Premail does not operate a cloud inbox that receives or stores your messages.

The assessment does not expand what Premail can access or change the permissions it requests. Google shows the requested access before you approve it, and you can revoke Premail's access from your Google Account at any time. Our Trust Center collects the rest: the current security and privacy posture, an overview of external data flows, and the policies that govern your data.