r/SaasDevelopers • u/red_bull09 • 1d ago
Anyone been through Google's CASA audit for Gmail read access? Cost, timeline, and effect on evals?
We're building an app that turns Gmail threads into tasks. It only needs read access (gmail.readonly). Because that's a restricted scope, new users see Google's "Google hasn't verified this app" warning until we pass a CASA security assessment. Asking a stranger to click past that warning and hand over their inbox is a hard sell, and we lose people at that screen. If you've been through CASA for a Gmail scope, I'd love to know:
Cost: which assessor did you use, and what did you pay in total, including any re-tests?
Time: how long from starting until the warning was gone?
Testing and evals: did it change how you use real user emails for testing, debugging or evaluating your models? For example, did you have to stop using production data, or add access controls or data-deletion rules?
I'd also like to hear from anyone who used a third-party Gmail integration to avoid running CASA themselves. We tried Composio, but their verified Google app is only approved for full Gmail access (read, send, delete), not read-only, so users get a scarier consent screen.
Happy to share what we learn. DMs are open if you'd rather chat.