Project: StratoFusion, Google Cloud project statafusion, project number
856037110351
This is a decision and handoff record, not a certification claim. It contains
no OAuth secrets, tokens, credentials, or test-account passwords.
Update — 2026-08-27: Google's 2026-08-26 follow-up asks for a stronger
full-Drive justification, exact source/console/consent alignment, a new
end-to-end video, and active reviewer access. The current response package is
Google OAuth Verification Response — 2026-08-27.
This supersedes the response timing and evidence assumptions below; the
historical assessor record remains useful context.
Executive Decision
Continue the current Google restricted-scope review. Do not cancel it, change
publishing status, remove the Drive scope, or edit verified branding while the
review is active. Contact TAC Security first and at least two other currently
authorized labs using the identical RFQ below. Ask the selected lab to request
an extension immediately because the assigned 2026-08-07 deadline is four
calendar dates after this review and every published delivery estimate exceeds
that window.
The least-cost published TAC product is currently $675 per application, but
it is labelled AL1, while Google's 2026-05-09 email assigned a legacy-named
Tier 2 assessment. Eligibility is therefore unconfirmed. Do not purchase it
until TAC confirms in writing that it satisfies this exact Google notification
and results in a Google-accepted Letter of Validation (LoV).
1. Live Google Status
Read-only Google Auth Platform inspection on 2026-08-03 found:
Item
Current evidence
Project
statafusion; StratoFusion selected
Review
Data access under review; app currently under verification
Branding
Verified and shown to users
Audience
External; publishing status In production
Users
15 of the displayed 100-user cap
Restricted scope
https://www.googleapis.com/auth/drive; not yet verified
Completed steps
App functionality, appropriate data access, minimum scopes
Explicit error
Privacy URL unresponsive; last reviewed 2026-07-22
Homepage, privacy, and terms exactly match production URLs
Cancellation control
None found on the inspected current review/settings pages
The full Drive justification already covers cross-provider browsing, search,
upload/download, copy/move/delete, scheduled backup, and sync. Google's first
three review steps are complete, so changing scope now has no evidenced benefit
and creates cancellation/re-review risk.
Review history from Gmail
2026-05-07: Google asked whether drive.file plus Picker was sufficient.
2026-05-08: Google requested more technical justification and evidence.
2026-05-09: StratoFusion replied that scheduled/background recursive backup,
future-file access, cross-provider operations, and rclone workflows require
the full Drive scope.
2026-05-09: Google assigned annual CASA Tier 2 with a 2026-08-07 deadline,
warned it can take up to six weeks, named TAC as the preferred discounted
route, and directed extension requests to an authorized lab.
2026-04-03: an earlier verification was automatically cancelled after a
configuration/publishing-state reversal. The notice listed multiple possible
causes and did not identify which one occurred.
No newer Google Trust and Safety message was found in the connected mailbox
through 2026-08-03.
Required Google response
Google's live dialog says to resolve highlighted issues and reply to the
existing Trust and Safety email. The privacy page is healthy now, but the reply
should be sent only after the selected lab confirms the extension/assessment
path. Sending remains approval-gated.
2. Privacy URL Evidence
Passive requests were captured at 2026-08-02T19:26:15Z (2026-08-03 AEST).
URL
Chrome UA
Googlebot UA
Google Inspection UA
Redirect
https://stratofusion.io/
200
200
200
None
https://stratofusion.io/legal/privacy
200
200
200
None
https://stratofusion.io/legal/terms
200
200
200
None
All three returned HTML over a trusted TLS connection. The privacy response
served the expected title and the production policy discloses Google Drive data
access, use, storage, sharing, retention, deletion, no sale/advertising use,
and no generalized-AI training.
The production release currently redirects /robots.txt and /sitemap.xml to
/sign-in. This does not explain a direct privacy-page failure because all
three crawler user agents can fetch the privacy URL directly. Uncommitted local
work already creates and public-allows both metadata routes, but it has not been
deployed.
No 2026-07-22 availability log or matching repository change was found. The
only proven historical fact is Google's observation that the URL was
unresponsive that day. A transient DNS/TLS/runtime incident around the recent
VM cutover is plausible but remains an inference, not an established root
cause.
The 2026-06-03 specification/test guide contains 48 tests in seven categories.
The former 73-control ASVS 4.0/Tier 1-3 material remains visible on some lab
sites and old ADA pages. Current ADA pages use AL1/AL2; the framework user
(Google), not the developer, determines the required assurance level.
There is a source inconsistency: the current ADA assurance-level page describes
both levels as lab tested/lab verified, while the v2.1.1 test guide defines AL1
as developer evidence reviewed by a lab and AL2 as direct lab testing. Google's
email still says Tier 2. The safe interpretation is to preserve Google's
assigned requirement and obtain written lab confirmation; price labels alone
cannot resolve the mismatch.
4. Assessor Comparison
The ADA list dated
2026-06-26 is authoritative. It names TAC, Bishop Fox, KPMG, Leviathan, NCC
Group, NetSentries, Orange Cyberdefense South Africa, Prescient Security, and
DEKRA.
RBA's 2026-07-31 reference rate was 1 AUD = 0.7030 USD. AUD estimates below
divide the displayed dollar amount by 0.7030 and exclude tax, card, and FX fees.
TAC's page does not state the currency, so its AUD values assume USD and require
quote confirmation.
Option
Published offer
Timing
Approx. AUD
Eligibility confidence
TAC Basic
$675, AL1, 2 revalidation cycles, LoV
2-3 weeks
$960
Low until written Tier 2 confirmation
TAC Premium
$855, AL1, unlimited rescans, LoV
2-3 weeks
$1,216
Low until written Tier 2 confirmation
TAC Enterprise AL2
$4,500 annual, direct AL2, LoV
2-4 weeks
$6,401
High terminology match; still confirm Google notification
Leviathan Priority
$6,000 AL1, one retest
starts within 2 days
$8,535
Fast start; AL1 completion/eligibility unknown
Leviathan Standard
$4,500 AL1, one retest
starts within 10 days
$6,401
Deadline-incompatible without extension
NetSentries
Explicit legacy Tier 2 validation and LoV
Quote required
Unknown
Strong wording match; site still cites old 73 controls
TAC first because Google named it, it is currently authorized, and it has
the only low public entry price.
NetSentries in parallel because it explicitly advertises legacy Tier 2.
Bishop Fox and Leviathan Priority as schedule/quality alternatives.
Choose the least-cost quote that confirms, in writing, exact acceptance for
Google's 2026-05-09 notification, extension handling, current control set,
LoV delivery, and included retests.
5. Identical RFQ Draft
Subject: Urgent Google CASA quote and extension — StratoFusion — due 7 Aug 2026
StratoFusion has a Google OAuth restricted-scope verification in progress for
Google Cloud project statafusion (856037110351). Google's 9 May 2026 notice
assigns “CASA Tier 2” for https://www.googleapis.com/auth/drive, due 7 August
2026, and says an authorized lab may request an extension.
Please confirm in writing: (1) which current CASA product/assurance level
satisfies this exact Google notification; (2) fixed total price, currency,
taxes and payment timing; (3) earliest kickoff and realistic LoV date; (4)
whether you will request the Google deadline extension immediately; (5) the
specification/control version you will assess; (6) developer versus lab
testing responsibilities; (7) included remediation/retest cycles and SLA;
(8) required access, evidence, scanners and test accounts; and (9) whether the
LoV is sent directly to Google.
Production is a Next.js application on an OVHcloud VM Compose stack with
PostgreSQL and an authenticated rclone worker. We can provide the Google
notice, architecture/data-flow pack, current 48-test evidence matrix, privacy
policy, non-secret configuration evidence, and dedicated sample accounts.
Please do not begin active production scanning until we approve the scope and
test window.
6. TAC-Specific Draft
Subject: Confirm $675 eligibility before purchase — Google assigned CASA Tier 2
Google specifically named TAC as its preferred discounted assessor. Your
current Basic page shows $675 and labels the product AL1, while Google's notice
says Tier 2. Before purchase, please confirm that Basic at $675 will satisfy
this exact notification and produce a Google-accepted LoV. If not, identify
the minimum eligible product. Please also confirm currency, taxes, two-cycle
meaning, extension handling, earliest kickoff, expected LoV date, and whether
you assess the current CASA v2.1.1 48-test guide or the older 73-control set.
7. Google Reply Draft
Reply in the existing Trust and Safety thread; do not start a new case.
Hello Google Trust and Safety,
We have resolved the highlighted privacy-policy availability issue. The exact
submitted URL, https://stratofusion.io/legal/privacy, now returns HTTP 200
without redirect over valid TLS for normal browsers, Googlebot, and Google
Inspection user agents. The homepage and Terms URL are also responsive.
We are engaging an ADA-authorized CASA assessor for the Tier 2 requirement
assigned on 9 May 2026. Because the assessor process exceeds the 7 August
deadline, we have asked the lab to request an extension and will provide the
assessor/extension reference as soon as it is issued.
We continue to require the full Drive scope for user-authorized browsing,
search, transfer, scheduled backup, and sync across current and future files,
as documented in our 9 May response. We have not changed the requested scope,
publishing status, or verified branding.
Please resume the privacy/homepage review and confirm whether any additional
evidence is needed while the CASA assessment proceeds.
8. Execution Plan And Approval Gates
Date
Action
Owner/gate
2026-08-03
Approve and send identical RFQs; lab requests extension
User approval required before contact
2026-08-04
Compare written eligibility, price, start, retests; approve purchase
User approval and payment required
2026-08-04/05
Confirm scope, evidence channel, test accounts, scan window
User/lab
2026-08-05 onward
Deploy approved security changes, then lab testing/remediation
Deployment and active-scan approvals required
2-4 weeks
LoV submission and Google follow-up
Lab plus user-approved reply
Do not send messages, submit forms, purchase, change Google configuration,
deploy, or actively scan production without the explicit approval required by
the engagement prompt.
9. Readiness Snapshot
Ready locally: production dependency audit is clean; token encryption,
route-auth scanner, and secret/log scanner pass; OAuth state is now signed,
expiring, and rejects tampering; focused tests, lint, and typecheck pass.
Ready in current production: homepage/privacy/terms availability, TLS,
security headers, authenticated app boundary, rclone health.
Not yet production-ready evidence: local OAuth-state and crawler-route fixes
are undeployed; admin MFA enforcement is not evidenced; logout browser-storage
clearing needs review; active DAST/SAST and lab verification are pending.
Bounded verification caveat: the full test suite exceeded five minutes and
the production build exceeded ten minutes without returning results. Both are
recorded as inconclusive, not failures; no deployment was attempted.
10. Effort Log
Rounded working time for this engagement: approximately 1 hour 45 minutes —
Google/Gmail review 20 minutes; public URL and source research 25 minutes;
repository/control audit 25 minutes; security remediation and tests 25 minutes;
decision pack and drafts 10 minutes. External assessor time and any future
deployment/remediation are not included.