Independent review
The assessment was conducted by a third party authorized to evaluate applications under the CASA framework. This was not Premail grading its own work.
Independent security assessment
The entire Premail application has undergone a third-party security assessment.
Google required the review because Premail connects to Gmail, but the assessment was not limited to our Google integration. An independent assessor evaluated the full application under the Cloud Application Security Assessment framework, known as CASA.
CASA framework
Reviewed by an independent assessor
A security review of the full Premail application, requested by Google and performed by a third party.
Cloud Application Security Assessment
What CASA means for you
A third party examined the security controls across Premail
Google requires apps that request restricted access to user data to complete an independent security assessment. CASA provides the standardized framework used for that review, based on the OWASP Application Security Verification Standard. For Premail, the assessment covered the entire application, not only the features that connect to Google.
The full application was in scope
The assessor evaluated Premail as a whole, not only its Google connection. The review covered the application and the security practices supporting it.
Required by Google
Google requested the assessment because Premail accesses Gmail data. An independent assessor conducted the review, and Google requires annual reassessment.
A security assessment is a point-in-time evaluation, not a claim that any software is risk-free. Premail continues to maintain and improve its controls as the product evolves.
Defense in depth
The assessment backs up a privacy-conscious architecture
The CASA assessment evaluated Premail as a whole. Premail's architecture also reduces how much infrastructure sits between you and your inbox in the first place.
Scoped Google access
Premail requests Gmail access to classify and organize messages. You review the requested permissions before connecting and can revoke access at any time.
Local-first by design
Mailbox connections and filtering run in the desktop app. Premail does not operate a server that receives, stores, or processes your email.
Credentials stay with you
OAuth tokens and app-specific passwords are stored in your operating system keychain. They are not sent to or retained by Premail servers.
Where your data goes
Premail has no cloud inbox in the middle. Connections go from your computer to the services you explicitly choose.
- 1
Mail provider
The app connects directly to Gmail, Outlook, or iCloud to retrieve and organize mail.
- 2
Your computer
Rules, account configuration, and activity history stay local to the Premail app.
- 3
Your chosen AI
Classification goes directly to the AI provider you configure, or stays entirely on-device when you use Ollama.
Policies and disclosure
Privacy Policy
What Premail collects, processes, retains, and never sells.
AI Disclosure
How classification works and what each AI provider receives.
Terms of Service
The terms and responsibilities that apply when using Premail.
Found a security issue?
Please report suspected vulnerabilities privately so they can be investigated before public disclosure.