Google CASA ops guide

• OAuth consent screen: Publishing status = Testing
• Add every pilot mailbox as a Test user in Google Cloud Console
• Document that connections may show Needs reconnect after ~7 days
• Use Fiko reconnect UX (channel details → Reconnect Google)

Phase B — Pre-submission prep

• Privacy policy URL publicly accessible (describe Gmail data: read, send, store encrypted refresh token)
• Terms of service URL
• Application homepage URL (fiko.ai or docs site)
• Scope justification document: why modify + send are minimum necessary for unified inbox + reply
• Demo video: OAuth connect → inbound email → chat → agent reply (≤ 2 minutes)
• List data retention: refresh token encrypted at rest; mail content in your DB per product policy
• Confirm minimum scope — do not request gmail.readonly if modify is required for watch/send

Phase C — Google verification

1. 1OAuth consent screen → Publish app → Submit for verification
2. 2Complete Brand verification if prompted (logo, domain ownership)
3. 3Answer Google questionnaire on data handling, encryption, deletion on disconnect
4. 4Fiko disconnect flow revokes Google token, stops watch, wipes stored credentials — mention in submission
5. 5Expect 4–6 weeks for restricted scope review (variable)

Phase D — CASA (Cloud Application Security Assessment)

Google may require CASA Tier 2 or Tier 3 assessment from an authorized lab for restricted Gmail scopes. CASA validates OWASP-style controls on your OAuth app and backend handling of Google user data.

• Engage a Google-approved CASA assessor when Google requests it in verification portal
• Prepare: architecture diagram (Fiko FE → messaging-service → Gmail API, encrypted token storage)
• Document token lifecycle: OAuth callback → Redis pending → AES-256-GCM → channel config
• Document disconnect: revoke at Google, stop Pub/Sub watch, wipe EMAIL_OAUTH_REFRESH_TOKEN
• Document access controls: tenant isolation by companyId, agent RBAC on channels
• Provide penetration test / vulnerability scan results if assessor requires
• Remediation loop: fix findings → re-assess → upload CASA letter to Google

Phase E — Production cutover

• Verification approved → OAuth consent screen shows In production
• Remove 100 test-user cap — any Google user can consent
• Refresh tokens no longer expire on 7-day Testing schedule
• Monitor Fiko needs_reconnect metrics and token health cron logs
• Communicate to customers: reconnect once after cutover if they connected during Testing

What Fiko stores

• • Encrypted OAuth refresh token on channel configuration
• • Mailbox address, connection status, watch cursor state
• • Email message content in chat/message tables (product data retention policy applies)

On disconnect

• • Revoke refresh token at Google OAuth revoke endpoint
• • Stop Gmail Pub/Sub watch
• • Wipe OAuth credentials from channel config; status → pending

What Fiko does not do

• • Sell Gmail data to third parties
• • Use Gmail data for ads or unrelated ML training (state your actual policy)
• • Request broader scopes than needed for support inbox workflow