Google CASA Verification Explained for Email Tool Buyers

Every time you authorize a Gmail-connected app, you hand it real access to your inbox. Most users click through the OAuth consent screen without reading which permissions they are granting. The words 'Google hasn't verified this app' appearing on that screen carry a specific technical meaning — and for apps that want to read or modify your entire mailbox, clearing that warning requires passing a named process that most buyers have never heard of.

That process is the Google CASA verification: an independent security assessment required for any app requesting restricted Gmail API scopes. Understanding what it covers, how it works, and how to check a vendor's status before you authorize their tool is what this guide covers.

What is Google CASA verification?#

Google CASA (Cloud Application Security Assessment) is a mandatory annual security audit for apps that request restricted Gmail API scopes. Restricted scopes are the permissions that grant access to a user's entire inbox — reading, labeling, and modifying messages — rather than narrow actions like composing a single message to a specific recipient.

An app must pass this assessment and submit a Letter of Assessment to Google before Google marks it as verified on the OAuth consent screen. The assessment is conducted not by Google's own team but by a lab approved by the App Defense Alliance (ADA), a coalition of security organizations that defines the evaluation framework. Assessors evaluate the application against criteria drawn from the OWASP Application Security Verification Standard, covering how the app handles authentication, data storage, encryption, session management, and access controls.

The API scopes that trigger the CASA requirement for a Gmail-connected email client are typically mail.google.com (full mailbox access) and gmail.modify (read, compose, send, and delete messages). If an app processes data from those scopes on its own servers — rather than operating entirely client-side with no back-end — it falls within the CASA requirement. A passing grade means the app met that security baseline at the time of assessment. It is not Google endorsing the product's quality or features more broadly.

How the CASA assessment process works#

CASA is not a form you submit on a weekend. The process involves an independent security lab, a structured evaluation framework, and a review by Google before verified status is granted. For email clients requesting restricted Gmail access, this is CASA Tier 2 — the tier that requires an independent lab rather than self-certification.

1. 1

   Identify the scopes in use

   The developer determines which Gmail API scopes the app requires. Any restricted scope — such as gmail.modify or mail.google.com — triggers the CASA requirement. The exact scope list is visible to users on the OAuth consent screen before they authorize.

2. 2

   Engage an App Defense Alliance approved lab

   The developer selects a lab from the App Defense Alliance's published assessor list. Labs are vetted by the ADA. The developer cannot self-certify at Tier 2 — an independent review is the requirement.

3. 3

   Complete the security assessment

   The lab evaluates the application against OWASP ASVS criteria: authentication, session management, data protection, cryptography, API security, and access control. The assessment scope covers how the app handles the Gmail data it receives, not just the OAuth flow itself.

4. 4

   Receive the Letter of Assessment

   If the app passes, the assessor issues a formal Letter of Assessment documenting the findings and confirming the app met the required security criteria at the time of evaluation.

5. 5

   Submit to Google

   The developer submits the Letter of Assessment, along with verification documentation and a privacy policy, through Google's OAuth verification request process. Google reviews the submission and grants verified status per scope.

6. 6

   Annual recertification

   The assessment repeats annually. A lapse means verified status can expire. Buyers evaluating a vendor can ask directly when the most recent assessment was completed and for which scopes.

What happens without CASA: the unverified app experience#

If an app requests restricted Gmail scopes without completing the CASA process, Google blocks it from the standard OAuth consent flow or surfaces a prominent warning screen — red background, the phrase 'Google hasn't verified this app,' a security icon — that most users interpret as a sign something is wrong. For production apps that have exceeded the testing-mode user cap, Google requires completing verification before any user can grant access at all.

From the user's side, the only path forward past that warning is to click 'Advanced' and then 'Go to [App Name] (unsafe).' Most buyers will not know whether the warning means the app is new, mid-assessment, or has a real problem. The technical answer is specific: it means the app has not completed the required CASA assessment for its requested scopes. That could be harmless (a new tool in process) or meaningful (a tool that has not prioritized the step). You cannot tell from the warning alone.

Beyond user experience, an unverified app faces operational limits. Google can revoke OAuth tokens for unverified apps that exceed the testing-mode cap. Google Workspace administrators can configure their domain to block all unverified third-party apps through Admin Console policies — which means an email tool that has not passed CASA may not be deployable in a corporate environment, regardless of its features or pricing.

CASA vs standard OAuth verification: what is the difference?#

CASA is often confused with the basic Google verification process that covers less powerful scopes. The two represent meaningfully different levels of scrutiny, and the distinction matters because it determines what a verified badge on the OAuth consent screen actually guarantees.

Common misconceptions about Google CASA#

Several things buyers assume about CASA turn out to be wrong. Each one affects how you should interpret a vendor's verification status.

• CASA is not a Google endorsement. A verified badge means the app cleared an independent security baseline at a point in time, not that Google recommends the product's quality, reliability, or features.
• Unverified does not always mean unsafe. An app may be mid-assessment, or it may only use sensitive rather than restricted scopes and therefore not require CASA at all. The warning means the scopes requested have not been verified through the CASA process — not that the app was found dangerous.
• CASA does not cover the entire product. The assessment evaluates the application's security posture at the time of review. It does not assess what the vendor does with your data after it arrives, breach notification practices, feature completeness, or long-term data handling.
• Passing once is not permanent. The assessment is annual. A product that passed two years ago and has not recertified may no longer carry valid verified status. Ask any vendor for the date of their most recent assessment.
• There is no public registry to check. The Letter of Assessment is submitted to Google, not published openly. The only buyer-visible signal is the verified status on the OAuth consent screen during account connection — and even that does not distinguish between standard verification and CASA.

How CASA shows up in AI Emaily#

CASA is the reason the 'Google hasn't verified this app' screen does not appear when you connect AI Emaily to Gmail. AI Emaily requests restricted Gmail scopes because a full email client — one that labels, archives, triages, and manages your inbox — cannot operate on narrower permissions. We completed Google's independent CASA restricted-scope assessment in July 2026, passing the OWASP-based audit conducted by an App Defense Alliance approved lab. The OAuth consent screen for AI Emaily shows verified status for the scopes it requests, and Workspace administrators can approve it under standard enterprise policies without adding a manual exception.

We build AI Emaily. The CASA status means your mail is handled by an app that cleared the independent security bar Google requires — not a self-reported claim. The approach to how we handle your data is at aiemaily.com/security.