Zellbox passes Google CASA Tier 2 security assessment

Zellbox just cleared Google’s Cloud Application Security Assessment (CASA) at Tier 2. The audit was carried out by an independent authorised lab against the ISO/IEC 27001 controls framework, plus Google’s own CAIQ (Consensus Assessments Initiative Questionnaire), between June and July 2026.

If you connect Zellbox to your Gmail account so operators can send patient / customer emails from their own inbox, or if you connect your Google Calendar so appointments round-trip between the two, you’re relying on Google OAuth restricted scopes. Google reviews every app using those scopes annually. Without a passing CASA report on file, they can revoke access at renewal — no warning, no grace period.

Zellbox passed on the first submission.

What CASA Tier 2 actually covers

CASA Tier 2 is the full-scope tier. It’s not a self-attestation — an authorised lab does the work independently and reports back to Google. The scope Zellbox went through:

• Dependency vulnerability scan (SCA). Every package.json in the repository — frontend, backend services, blog, docs, and every tool script — audited via npm audit --omit=dev. Any high or critical finding blocks the audit; Zellbox went in with zero high-or-critical.
• Static code analysis (SAST). Semgrep with the OWASP rule pack + ESLint’s security plugin across the whole TypeScript + JavaScript surface. Every warning triaged; every real finding fixed before submission.
• Secret scanning across git history. Gitleaks against the full repository history — not just HEAD — to catch anything a developer might have committed once and reverted.
• Dynamic application security testing (DAST). OWASP ZAP baseline scan against the live production environment, covering the public HTTP surface end-to-end.
• Architecture review. Full architecture diagram + threat model, explaining every trust boundary, every data-in-transit path, and every stored-data category with its encryption details.
• Evidence-backed answers to the CAIQ questionnaire — 15+ specific control questions covering data encryption (at-rest with customer-managed keys, in-transit via TLS 1.2+), incident response (with a documented policy), secret rotation policy, and secure development lifecycle.

Why we sat this exam early

We ran the internal prep in the weeks before our upcoming CASA review — the goal was to walk into the lab engagement with a clean baseline so the audit surface was as focused as possible. Every finding the lab would have flagged, we’d already fixed. That kept the audit focused and the timeline predictable.

For operators, the passing report means:

• The Google Calendar sync you rely on for appointment round-tripping remains authorised past Google’s enforcement review.
• The Gmail integration — where operators send patient emails from their own Gmail account instead of a Zellbox mailer — remains authorised past Google’s enforcement review.
• Your consent-workflow audit trail stays intact (the signed-consent PDF workflow depends on Documents in Google Drive for some workspaces).

What comes next

CASA isn’t a one-shot. Google requires a renewal every 12-24 months depending on scope tier and lab findings. Zellbox’s next review lands in 2027; the internal SAST / SCA / secret-scan pipeline stays live in between so any regressions get caught the same week they land instead of the week before submission.

Also on the compliance roadmap: SOC 2 Type II (Q4 2026), ISO/IEC 27001 (2027).

If you’re evaluating Zellbox for a workspace that requires a security posture stronger than “we use HTTPS”, the CASA Tier 2 status is now part of the pitch. Reply to any of our onboarding emails and we’ll send the executive summary of the audit report on request.

[Screenshot of the CASA Tier 2 shield here]