# Google OAuth Verification And CASA Engagement Date: 2026-08-03 (Australia/Sydney) Project: StratoFusion, Google Cloud project `statafusion`, project number `856037110351` This is a decision and handoff record, not a certification claim. It contains no OAuth secrets, tokens, credentials, or test-account passwords. > **Update — 2026-08-27:** Google's 2026-08-26 follow-up asks for a stronger > full-Drive justification, exact source/console/consent alignment, a new > end-to-end video, and active reviewer access. The current response package is > [Google OAuth Verification Response — 2026-08-27](./GOOGLE_OAUTH_VERIFICATION_RESPONSE_2026-08-27.md). > This supersedes the response timing and evidence assumptions below; the > historical assessor record remains useful context. ## Executive Decision Continue the current Google restricted-scope review. Do not cancel it, change publishing status, remove the Drive scope, or edit verified branding while the review is active. Contact TAC Security first and at least two other currently authorized labs using the identical RFQ below. Ask the selected lab to request an extension immediately because the assigned 2026-08-07 deadline is four calendar dates after this review and every published delivery estimate exceeds that window. The least-cost published TAC product is currently `$675` per application, but it is labelled `AL1`, while Google's 2026-05-09 email assigned a legacy-named `Tier 2` assessment. Eligibility is therefore unconfirmed. Do not purchase it until TAC confirms in writing that it satisfies this exact Google notification and results in a Google-accepted Letter of Validation (LoV). ## 1. Live Google Status Read-only Google Auth Platform inspection on 2026-08-03 found: | Item | Current evidence | | -------------------- | ---------------------------------------------------------- | | Project | `statafusion`; StratoFusion selected | | Review | Data access under review; app currently under verification | | Branding | Verified and shown to users | | Audience | External; publishing status In production | | Users | 15 of the displayed 100-user cap | | Restricted scope | `https://www.googleapis.com/auth/drive`; not yet verified | | Completed steps | App functionality, appropriate data access, minimum scopes | | Explicit error | Privacy URL unresponsive; last reviewed 2026-07-22 | | Still in progress | Homepage, branding guidelines, additional requirements | | Public URLs | Homepage, privacy, and terms exactly match production URLs | | Cancellation control | None found on the inspected current review/settings pages | The full Drive justification already covers cross-provider browsing, search, upload/download, copy/move/delete, scheduled backup, and sync. Google's first three review steps are complete, so changing scope now has no evidenced benefit and creates cancellation/re-review risk. ### Review history from Gmail - 2026-05-07: Google asked whether `drive.file` plus Picker was sufficient. - 2026-05-08: Google requested more technical justification and evidence. - 2026-05-09: StratoFusion replied that scheduled/background recursive backup, future-file access, cross-provider operations, and rclone workflows require the full Drive scope. - 2026-05-09: Google assigned annual CASA Tier 2 with a 2026-08-07 deadline, warned it can take up to six weeks, named TAC as the preferred discounted route, and directed extension requests to an authorized lab. - 2026-04-03: an earlier verification was automatically cancelled after a configuration/publishing-state reversal. The notice listed multiple possible causes and did not identify which one occurred. - No newer Google Trust and Safety message was found in the connected mailbox through 2026-08-03. ### Required Google response Google's live dialog says to resolve highlighted issues and reply to the existing Trust and Safety email. The privacy page is healthy now, but the reply should be sent only after the selected lab confirms the extension/assessment path. Sending remains approval-gated. ## 2. Privacy URL Evidence Passive requests were captured at `2026-08-02T19:26:15Z` (2026-08-03 AEST). | URL | Chrome UA | Googlebot UA | Google Inspection UA | Redirect | | --------------------------------------- | --------: | -----------: | -------------------: | -------- | | `https://stratofusion.io/` | 200 | 200 | 200 | None | | `https://stratofusion.io/legal/privacy` | 200 | 200 | 200 | None | | `https://stratofusion.io/legal/terms` | 200 | 200 | 200 | None | All three returned HTML over a trusted TLS connection. The privacy response served the expected title and the production policy discloses Google Drive data access, use, storage, sharing, retention, deletion, no sale/advertising use, and no generalized-AI training. The production release currently redirects `/robots.txt` and `/sitemap.xml` to `/sign-in`. This does not explain a direct privacy-page failure because all three crawler user agents can fetch the privacy URL directly. Uncommitted local work already creates and public-allows both metadata routes, but it has not been deployed. No 2026-07-22 availability log or matching repository change was found. The only proven historical fact is Google's observation that the URL was unresponsive that day. A transient DNS/TLS/runtime incident around the recent VM cutover is plausible but remains an inference, not an established root cause. ## 3. Current CASA Terminology Current primary sources: - [CASA overview](https://appdefensealliance.dev/casa) - [Authorized assessors](https://appdefensealliance.dev/casa/casa-assessors) - [Assurance levels](https://appdefensealliance.dev/casa/casa-tiering) - [Framework-user process](https://appdefensealliance.dev/casa/casa-start) - [CASA specification v2.1.1](https://github.com/appdefensealliance/ASA-WG/blob/main/CASA/CASA%20Specification.md) - [CASA test guide v2.1.1](https://github.com/appdefensealliance/ASA-WG/blob/main/CASA/CASA%20Test%20Guide.md) - [Google restricted-scope verification](https://developers.google.com/identity/protocols/oauth2/production-readiness/restricted-scope-verification) The 2026-06-03 specification/test guide contains 48 tests in seven categories. The former 73-control ASVS 4.0/Tier 1-3 material remains visible on some lab sites and old ADA pages. Current ADA pages use AL1/AL2; the framework user (Google), not the developer, determines the required assurance level. There is a source inconsistency: the current ADA assurance-level page describes both levels as lab tested/lab verified, while the v2.1.1 test guide defines AL1 as developer evidence reviewed by a lab and AL2 as direct lab testing. Google's email still says `Tier 2`. The safe interpretation is to preserve Google's assigned requirement and obtain written lab confirmation; price labels alone cannot resolve the mismatch. ## 4. Assessor Comparison The [ADA list](https://appdefensealliance.dev/casa/casa-assessors) dated 2026-06-26 is authoritative. It names TAC, Bishop Fox, KPMG, Leviathan, NCC Group, NetSentries, Orange Cyberdefense South Africa, Prescient Security, and DEKRA. RBA's 2026-07-31 reference rate was `1 AUD = 0.7030 USD`. AUD estimates below divide the displayed dollar amount by 0.7030 and exclude tax, card, and FX fees. TAC's page does not state the currency, so its AUD values assume USD and require quote confirmation. | Option | Published offer | Timing | Approx. AUD | Eligibility confidence | | ------------------ | -------------------------------------------- | ---------------------------------- | ----------: | --------------------------------------------------------- | | TAC Basic | $675, AL1, 2 revalidation cycles, LoV | 2-3 weeks | $960 | Low until written Tier 2 confirmation | | TAC Premium | $855, AL1, unlimited rescans, LoV | 2-3 weeks | $1,216 | Low until written Tier 2 confirmation | | TAC Enterprise AL2 | $4,500 annual, direct AL2, LoV | 2-4 weeks | $6,401 | High terminology match; still confirm Google notification | | Leviathan Priority | $6,000 AL1, one retest | starts within 2 days | $8,535 | Fast start; AL1 completion/eligibility unknown | | Leviathan Standard | $4,500 AL1, one retest | starts within 10 days | $6,401 | Deadline-incompatible without extension | | NetSentries | Explicit legacy Tier 2 validation and LoV | Quote required | Unknown | Strong wording match; site still cites old 73 controls | | Bishop Fox | Authorized, extensive Google/CASA experience | reply by next business day claimed | Unknown | Quote and current-tier mapping required | | Remaining labs | Authorized | Quote required | Unknown | Use identical RFQ; no verified public price | Published sources: [TAC pricing](https://casa.tacsecurity.com/site/home), [Leviathan pricing](https://www.leviathansecurity.com/programs/google-casa-cloud-application-security-assessment), [NetSentries CASA](https://www.netsentries.com/service/casa), and [Bishop Fox CASA](https://bishopfox.com/services/vendor-assessments/casa/casa-reassessment). ### Recommendation 1. TAC first because Google named it, it is currently authorized, and it has the only low public entry price. 2. NetSentries in parallel because it explicitly advertises legacy Tier 2. 3. Bishop Fox and Leviathan Priority as schedule/quality alternatives. 4. Choose the least-cost quote that confirms, in writing, exact acceptance for Google's 2026-05-09 notification, extension handling, current control set, LoV delivery, and included retests. ## 5. Identical RFQ Draft Subject: Urgent Google CASA quote and extension — StratoFusion — due 7 Aug 2026 > StratoFusion has a Google OAuth restricted-scope verification in progress for > Google Cloud project `statafusion` (856037110351). Google's 9 May 2026 notice > assigns “CASA Tier 2” for `https://www.googleapis.com/auth/drive`, due 7 August > 2026, and says an authorized lab may request an extension. > > Please confirm in writing: (1) which current CASA product/assurance level > satisfies this exact Google notification; (2) fixed total price, currency, > taxes and payment timing; (3) earliest kickoff and realistic LoV date; (4) > whether you will request the Google deadline extension immediately; (5) the > specification/control version you will assess; (6) developer versus lab > testing responsibilities; (7) included remediation/retest cycles and SLA; > (8) required access, evidence, scanners and test accounts; and (9) whether the > LoV is sent directly to Google. > > Production is a Next.js application on an OVHcloud VM Compose stack with > PostgreSQL and an authenticated rclone worker. We can provide the Google > notice, architecture/data-flow pack, current 48-test evidence matrix, privacy > policy, non-secret configuration evidence, and dedicated sample accounts. > Please do not begin active production scanning until we approve the scope and > test window. ## 6. TAC-Specific Draft Subject: Confirm $675 eligibility before purchase — Google assigned CASA Tier 2 > Google specifically named TAC as its preferred discounted assessor. Your > current Basic page shows $675 and labels the product AL1, while Google's notice > says Tier 2. Before purchase, please confirm that Basic at $675 will satisfy > this exact notification and produce a Google-accepted LoV. If not, identify > the minimum eligible product. Please also confirm currency, taxes, two-cycle > meaning, extension handling, earliest kickoff, expected LoV date, and whether > you assess the current CASA v2.1.1 48-test guide or the older 73-control set. ## 7. Google Reply Draft Reply in the existing Trust and Safety thread; do not start a new case. > Hello Google Trust and Safety, > > We have resolved the highlighted privacy-policy availability issue. The exact > submitted URL, https://stratofusion.io/legal/privacy, now returns HTTP 200 > without redirect over valid TLS for normal browsers, Googlebot, and Google > Inspection user agents. The homepage and Terms URL are also responsive. > > We are engaging an ADA-authorized CASA assessor for the Tier 2 requirement > assigned on 9 May 2026. Because the assessor process exceeds the 7 August > deadline, we have asked the lab to request an extension and will provide the > assessor/extension reference as soon as it is issued. > > We continue to require the full Drive scope for user-authorized browsing, > search, transfer, scheduled backup, and sync across current and future files, > as documented in our 9 May response. We have not changed the requested scope, > publishing status, or verified branding. > > Please resume the privacy/homepage review and confirm whether any additional > evidence is needed while the CASA assessment proceeds. ## 8. Execution Plan And Approval Gates | Date | Action | Owner/gate | | ----------------- | -------------------------------------------------------------------- | --------------------------------------------- | | 2026-08-03 | Approve and send identical RFQs; lab requests extension | User approval required before contact | | 2026-08-04 | Compare written eligibility, price, start, retests; approve purchase | User approval and payment required | | 2026-08-04/05 | Confirm scope, evidence channel, test accounts, scan window | User/lab | | 2026-08-05 onward | Deploy approved security changes, then lab testing/remediation | Deployment and active-scan approvals required | | 2-4 weeks | LoV submission and Google follow-up | Lab plus user-approved reply | Do not send messages, submit forms, purchase, change Google configuration, deploy, or actively scan production without the explicit approval required by the engagement prompt. ## 9. Readiness Snapshot - Ready locally: production dependency audit is clean; token encryption, route-auth scanner, and secret/log scanner pass; OAuth state is now signed, expiring, and rejects tampering; focused tests, lint, and typecheck pass. - Ready in current production: homepage/privacy/terms availability, TLS, security headers, authenticated app boundary, rclone health. - Not yet production-ready evidence: local OAuth-state and crawler-route fixes are undeployed; admin MFA enforcement is not evidenced; logout browser-storage clearing needs review; active DAST/SAST and lab verification are pending. - Separate matrix: [CASA v2.1.1 Control Matrix](./CASA_V2_1_1_CONTROL_MATRIX_2026-08-03.md). - Bounded verification caveat: the full test suite exceeded five minutes and the production build exceeded ten minutes without returning results. Both are recorded as inconclusive, not failures; no deployment was attempted. ## 10. Effort Log Rounded working time for this engagement: approximately 1 hour 45 minutes — Google/Gmail review 20 minutes; public URL and source research 25 minutes; repository/control audit 25 minutes; security remediation and tests 25 minutes; decision pack and drafts 10 minutes. External assessor time and any future deployment/remediation are not included.