--- title: "ZenMail passed a CASA Tier 2 security assessment" slug: casa-tier-2-verification description: "ZenMail passed a CASA Tier 2 security assessment. Learn what the independent review means and how ZenMail protects Gmail data on your Mac." created_at: "2026-04-25" updated_at: "2026-07-25" author: "ZenMail Team" category: "Engineering" keywords: ["CASA Tier 2","Gmail security assessment","ZenMail security","Gmail data privacy","App Defense Alliance"] canonical_url: https://usezenmail.com/blog/casa-tier-2-verification --- # ZenMail passed a CASA Tier 2 security assessment > ZenMail passed a CASA Tier 2 security assessment for Gmail data security. Here is what the independent review means and how ZenMail keeps your inbox private. Email is personal. It contains conversations, documents, receipts, plans, and the small details of everyday life. That is why ZenMail passed a CASA Tier 2 security assessment as part of Google’s verification process for apps that access sensitive Gmail data. Passing the assessment means an independent security assessor reviewed how ZenMail protects Google user data against a recognized set of cloud application security requirements. ## What is CASA Tier 2? CASA stands for Cloud Application Security Assessment. It is the security framework used by Google and the App Defense Alliance to evaluate applications that request access to sensitive or restricted Google account data. A Tier 2 assessment goes beyond filling out a questionnaire. It requires technical evidence and a review of security controls designed to protect user data. You can read more about [Google’s security assessment process](https://support.google.com/cloud/answer/13465431?hl=en). ## Why this matters for a Gmail client A Gmail client needs permission to read messages, display threads, send replies, and perform actions such as archive, label, snooze, or delete. Those permissions are powerful, so users should expect more than a privacy promise. Passing CASA gave ZenMail a structured, independent review of the safeguards surrounding that access. It also reinforced the standard we use when designing new features: collect less, keep the email path simple, and protect credentials with the security tools built into the Mac. ## Your Gmail stays between Google and your Mac ZenMail connects directly from the app on your Mac to Google’s Gmail APIs. We do not run a separate mail server that receives or stores a copy of your inbox. Your Google sign-in credentials are handled through OAuth, and the tokens that keep you signed in are stored in macOS Keychain. Website analytics, product licensing, and the waitlist are separate systems; they do not receive the contents of your Gmail inbox. ## Private by design - Direct Gmail connection: mail travels between Google and the ZenMail app on your Mac. - Secure sign-in: OAuth tokens are stored in macOS Keychain. - Local-first speed: synchronized mail is cached on your Mac for fast access and offline work. - Safer rendering: email HTML is sanitized before it is displayed. - Clear control: ZenMail can remove an account and its local mail cache, and Google access can be revoked from your Google Account. The full details—including the categories of data used for sign-in, licensing, and website operation—are available in the [ZenMail Privacy Policy](/privacy). ## Security is an ongoing practice A security assessment is a milestone, not the end of the work. ZenMail continues to review its Gmail permissions, authentication, local storage, email rendering, dependencies, and account-removal behavior as the app evolves. We also keep the product architecture deliberately narrow: ZenMail is a native Gmail client for Mac, not a cloud inbox service. Fewer moving parts make the data path easier to understand and easier to protect. ## What you can do to protect your inbox ZenMail protects its side of the connection, and a few Mac and Google account settings make the whole system stronger: - Turn on two-step verification for your Google account. - Use a strong Mac login password and enable FileVault. - Keep macOS and ZenMail up to date. - Review third-party access in your Google account and remove apps you no longer use. - Lock your Mac whenever you step away. ## A trust milestone for ZenMail Passing the CASA Tier 2 assessment reflects the kind of product we want ZenMail to be: fast and focused on the surface, careful and transparent underneath. Your inbox should feel effortless without asking you to take its security on faith. ## Security assessment is one layer, not the finish line A point-in-time assessment does not make every future message or release safe by default. Product security also depends on ongoing updates, narrow permissions, safe local storage, and clear user controls. ZenMail’s [Shield overview](/blog/zenmail-shield-email-threat-detection) explains the app’s message-level protection workflow, while our [Gmail phishing guide](/blog/how-to-spot-phishing-emails-gmail) covers the checks users should still make. ## Frequently asked questions ### What is CASA Tier 2? CASA is the Cloud Application Security Assessment framework used by Google and the App Defense Alliance. A Tier 2 assessment requires technical evidence and independent review of security controls for applications handling sensitive Google user data. ### Why does a Gmail client need a security assessment? A Gmail client needs permission to read messages and perform actions such as sending, archiving, labeling, and deleting. Google uses security assessments for apps that request sensitive or restricted scopes. ### Does ZenMail store Gmail on its own servers? No. ZenMail connects from the app on your Mac directly to Google’s Gmail APIs. ZenMail does not operate a separate mail server that stores a copy of your inbox. ### Where does ZenMail store Google sign-in tokens? ZenMail uses Google OAuth and stores the tokens that keep you signed in inside macOS Keychain. ### Where can I read ZenMail’s full privacy details? The ZenMail Privacy Policy explains how Gmail access, local mail data, website analytics, waitlist information, purchases, and licensing are handled.