Does a public Gmail add-on hosted entirely in Apps Script require an external CASA assessment?

Google Workspace Developers Q&A
, , ,
1

We are evaluating a public Gmail add-on using gmail.modify and gmail.settings.basic for mailbox organization and native filter creation.

All Gmail processing would run in Google Apps Script, with no developer-operated backend receiving Gmail data.

We need clarification for two scenarios:

  1. Gemini receives only independently written user instructions, without Gmail-derived data.
  2. Gmail message content is sent from Apps Script to Gemini through Vertex AI.

Does either scenario qualify for an exemption from external security assessment because processing remains within Google-hosted services?

Please distinguish OAuth verification from external CASA assessment and cite the applicable policy. If this requires a decision from OAuth Trust & Safety, how can we request clarification before building the application or creating a Cloud project?

2

Hi guys. Any idea how one could get an answer from Google about this? Is anyone answering these posts? i see a lot of them with no answers.

Thank you.