Google CASA Tier 2 Security Assessment: The Annual Test Restricted-Scope Apps Must Pass to Keep Gmail, Drive & Calendar Access (2026)
If your app reads, stores, or transmits a user’s Gmail, Drive, Calendar, or Contacts data on a server, Google will not let it stay in production on trust alone. Once a year it has to clear an independent security assessment under the App Defense Alliance’s CASA framework — the hardest and most expensive stage of Google OAuth verification, and the one that quietly pulls apps out of production when it lapses.
What CASA Tier 2 actually is
CASA stands for Cloud Application Security Assessment, run through Google’s App Defense Alliance. Any app that touches restricted Google scopes from or through a third-party server has to complete it. In Tier 2, your application is scanned, and the scan results plus supporting evidence go to a Google-authorized assessor who verifies them — without needing direct access to your code or infrastructure — and issues a Letter of Validation (LOV). That document is what Google’s OAuth team needs before it will keep your restricted scopes live. (Google’s own verification pages call the approval a Letter of Assessment (LOA) — same gate, two names.)
Why this is the stage that stops most apps
It is not a form
Brand verification is a 2–3 day branding check. Sensitive-scope review is a video and a questionnaire. CASA Tier 2 is a real security assessment against mapped security requirements, and your app is expected to remediate every critical and high finding before an assessor will validate it.
The self-scan shortcut is gone
The App Defense Alliance has deprecated the old CASA self-scanning path. Compliance now follows the lab-verified route described in your notification email, with an authorized assessor in the loop. Older guides that tell you to just self-scan are out of date.
It gates production, not launch
Restricted-scope verification can take several weeks, and brand verification has to clear first. Until it does, your consent screen stays capped behind the unverified-app and testing warnings, limiting how many real users can grant access.
It looks at your whole data path
The assessment checks how your app handles, secures, transmits, and deletes Google user data — not one endpoint. A weak spot anywhere in storage, transport, or deletion can surface as a finding you have to fix.
How the CASA Tier 2 assessment runs
Notification
Google, as the App Defense Alliance partner, emails you that your app is in scope for a Tier 2 assessment. The annual clock starts here.
Scan
Your application is scanned with an approved security-testing tool against the CASA requirement set that maps to known weakness categories.
Remediate
Every failed requirement tied to a critical or high finding, plus any mandatory questionnaire items, has to be fixed. This is where the real work — and most of the delay — lives.
Submit to an assessor
The scan configuration, results, and any accepted industry certifications that can accelerate the review go to a Google-authorized assessor for verification.
Letter of Validation
The assessor issues the LOV / LOA that lets Google keep your restricted scopes approved for production use.
A Letter of Assessment is not permanent. Google requires apps to be re-assessed and re-verified at least every 12 months from the LOA approval date to keep access to any verified restricted scopes. Adding a new restricted scope can trigger a fresh assessment sooner. When the annual clock lapses, your production access to those scopes is at risk — and the recertification email often lands in an inbox nobody is watching.
Where apps get stuck or rejected
- Unresolved critical or high findings — an assessor will not validate an app that still fails mapped security requirements.
- Requesting more scope than the feature needs — Google expects least-privilege access; broad Gmail or Drive access for a narrow feature draws extra scrutiny.
- A privacy policy that does not meet the Limited Use requirements for restricted-scope data.
- Missing the recertification email because the Owner/Editor and support-contact accounts on the Cloud project are out of date.
- Treating it as one-time — letting the LOA lapse and losing production access to the scopes your product depends on.
Where this fits in the work we do
We prepare apps for the full restricted-scope path: scope minimisation, brand and sensitive-scope verification, the demonstration video, aligning the privacy policy to the Limited Use requirements, and getting the app ready for the CASA Tier 2 security assessment and its annual recertification. The aim is a submission that gives the assessor and Google’s review team as little as possible to send back.
Newer to this? Start with our overview of how Google OAuth verification works and the Google API verification service. If your app is stuck earlier — at the consent screen itself — read the common OAuth consent-screen errors first.
This guide is for information only and reflects Google and App Defense Alliance documentation current at the time of writing; requirements change, so confirm details against the official sources. We are an independent service and are not affiliated with or endorsed by Google LLC. Google and its authorized assessors make all verification and assessment decisions, and no specific outcome or timeline can be guaranteed.