What CASA Reviews for Gmail Apps
· By Matt Senter
Connecting an app to Gmail requires a meaningful level of trust. Google required Premail to undergo a Cloud Application Security Assessment (CASA) because the app accesses Gmail data. The assessment itself was broader: an independent third party evaluated the entire Premail application, not only its Google integration.
What CASA is
CASA is a security assessment framework for applications that access Google user data. Its review areas include authentication, data protection, vulnerability management, and secure development practices. In Premail's case, the full application was within the assessment scope.
CASA is distinct from Google OAuth verification. OAuth verification reviews an app's identity, requested permissions, and consent experience. The CASA assessment examined Premail's application security controls. Neither process guarantees that software is risk-free, and an assessment reflects the scope and point in time documented by its assessor.
How Premail limits Gmail access
Premail needs Gmail access to classify messages and carry out the actions you configure, such as archiving, labeling, or moving mail. The desktop app connects directly to Gmail; Premail does not operate a cloud inbox that receives or stores your messages.
The assessment does not expand what Premail can access or change the permissions it requests. You remain in control: Google shows the requested access before you approve it, and you can revoke Premail's access from your Google Account at any time.
Security is ongoing work
No assessment or authorization flow replaces ongoing security work. We continue maintaining Premail's controls, dependencies, and development practices as the product evolves. We also explain plainly what data Premail uses, why it needs access, and how users stay in control.
Our Trust Center brings that information together. Visit it for Premail's current security and privacy posture, an overview of external data flows, and links to the policies governing your data.