Security

Independent security assessment

QuietMail has completed a Tier 2 security assessment under the App Defense Alliance's Cloud Application Security Assessment (CASA) framework. The assessment was validated by TAC Security, an authorized CASA lab, in September 2026.

CASA is the security review Google requires of apps that access Gmail data through restricted scopes. It checks an application against a set of requirements built on the OWASP Application Security Verification Standard: authentication, session handling, access control, how data and secrets are stored, and scans of the running app. Passing it means an independent lab checked QuietMail against those requirements. It is not an endorsement by Google.

Validity

A CASA validation lasts twelve months. QuietMail's next revalidation is due in September 2027, and this page will show the new date once it is done.

Letter of Validation

TAC Security issued a Letter of Validation for the assessment. To get a copy, for example for a vendor or security review, use the in-app support chat or write to privacy@quietmail.app.

How QuietMail is built

The assessment covers the controls; the design keeps the risk small in the first place. The AI only reads a copy of each message and returns a judgment, with no tools and no access to your mailbox. Plain code carries out the one action you configured. Mailbox tokens are encrypted with AES-256-GCM, QuietMail never asks for a mailbox password, and every action is logged with an undo. The Privacy Policy describes exactly what data is accessed and kept.