Why Taskify Is CASA Verified and What It Means for Your Data

If you work in Dubai, your inbox probably holds client contracts, board updates, pricing, and personal data. Asking an AI assistant to read and act on it is a real step to take — and before you take it, you should be able to see proof that the tool is secure, not just read a claim on a landing page. Taskify has passed Google’s CASA security assessment and holds a Letter of Validation from an independent, Google-authorised lab.

What is CASA?

CASA (Cloud Application Security Assessment) is a third-party security audit for apps that connect to Google accounts. It was developed by the App Defense Alliance, an industry group founded by Google with leading cybersecurity firms.

The standard is built on the OWASP Application Security Verification Standard (ASVS), one of the most widely used security benchmarks in software. Google does not run the test itself — an independent, Google-authorised lab examines the app's authentication, session handling, access controls, encryption, and data handling against dozens of specific checks.

Apps that pass receive a Letter of Validation (LOV).

A company can't award itself CASA verification. It has to be earned through an outside audit.

Why Google requires it

Google classes some Gmail and Workspace permissions as sensitive or restricted because they expose private email content. Any app that requests restricted Gmail access, and processes that data on its own servers, must pass a CASA assessment before Google approves it for wider use.

The review isn’t a one-off. Apps must be re-assessed every 12 months to keep their access.

What the assessment verified for Taskify

Taskify connects to Gmail, Google Calendar, and Google Drive to handle the busywork that eats into your day. That means we handle some of your most sensitive information, and we didn’t want you to rely on our word alone. The independent lab confirmed that Taskify:

• Encrypts your data in transit and at rest
• Enforces strict access controls over who and what can reach your information
• Follows secure authentication and session-management practices
• Can fully delete your data on request

We will be re-assessed every year, so these standards are kept up, not just met once.

Why it matters for Dubai businesses

Data protection rules in the UAE are getting stricter, and they reach the software vendors you choose. Companies in DIFC follow the DIFC Data Protection Law No. 5 of 2020, which is closely modelled on GDPR. Most other businesses, including many in onshore Dubai and the non-financial free zones, fall under the UAE federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Both regimes expect companies to choose service providers that protect personal data properly. When your IT or compliance team reviews a new tool, CASA gives them something concrete to check: an independent audit and a Letter of Validation, not just a vendor's security page.

If your procurement team needs our security documentation, we're happy to share it during review.

What we don't do with your data

• We don't train AI models on your Google data. Your emails, calendar, and documents are used only to do the tasks you ask for.
• We ask only for the access we need. Each permission Taskify requests is tied to a specific feature.
• We don't sell your data. Your information isn't shared with advertisers or data brokers.

Built to earn your trust

Handing an AI assistant your inbox should never mean lowering your security standards. CASA verification means an independent lab has checked that Taskify protects your data the way we say it does.