CASA Security Assessment by Google: Plans, Pricing & Speed
What is a CASA security assessment?
A CASA security assessment is the App Defense Alliance (ADA) process that Google uses to verify applications requesting restricted OAuth scopes. An ADA-authorized lab reviews your evidence, or tests the app itself at AL2, and issues a Letter of Validation (LoV). CASA security, CASA assessment and CASA verification all describe this same process.
You don't pick your level. Google's Trust and Safety team assigns AL1 or AL2 in its notification email. AL1 (formerly Tier 2) is lab-validated scan and questionnaire evidence. AL2 is a full lab assessment. Official references: ADA CASA standard and the list of ADA authorized labs.
What should a startup founder compare in a CASA lab?
Compare four things: price, turnaround, retest terms, and how quickly the lab answers you. Every authorized lab produces an LoV, so the choice comes down to cost and the experience of getting there. A missed OAuth verification deadline can stall your launch, so responsiveness matters as much as the invoice.
- Price per application. Check whether retests, the LoV and the certification-body fee are included.
- Turnaround. Separate the lab's review time from your own remediation time. Only the first is something a lab can promise.
- Retests. Findings are common on a first scan. Unlimited retests remove the cost of fixing them in stages.
- Responsiveness. Look for a published response SLA, not just a "fast" claim.
How does Secusy CASA AL1 compare on price and speed?
Secusy is cheaper than the other Google-preferred assessor we compared on every AL1 tier, and it publishes review SLAs by plan. The comparison below uses Secusy's CASA AL1 pricing and the plans listed publicly on TAC Security's CASA page, checked on 1 November 2026. Their prices may change, so confirm on their site before you buy.
| Secusy Basic | TAC Basic | Secusy Advanced | TAC Premium | Secusy Fully Managed | TAC Enterprise AL1 | |
|---|---|---|---|---|---|---|
| Price (one-time, per app) | $499 | $675 | $599 | $855 | $3,000 | $3,600 |
| Retests | 2 included, then $75 each | 2 cycles | Unlimited | Unlimited | Unlimited | Unlimited |
| Lab timing | 2–5 business days once evidence is clean | 2–3 weeks assessment to LoV | 2–3 business days once clean | 2–3 weeks assessment to LoV | 2 business days once clean | 1–2 weeks assessment to LoV |
| Published response SLA | 3 business days | Not listed per plan | 2 business days | Not listed per plan | 2 business days | Not listed per plan |
The Basic row saves $176 (26%), Advanced saves $256 (30%) and Fully Managed saves $600 (17%). Read the timing row with care. Secusy's figures start when your questionnaire and scan evidence are clean, while the other lab quotes a window from assessment to LoV. For a first-time applicant, the honest end-to-end figure on Secusy is 1–5 weeks, because fixing findings takes the time it takes.
What you can hold Secusy to is the SLA. Each plan lists how fast the lab responds after you submit, and the customer portal tracks the status of your submission so you aren't chasing email.
What about CASA AL2?
CASA AL2 costs $5,400 per application at both Secusy and the other lab we compared, so price is not a differentiator at this level. The differences are in the terms. Secusy's CASA AL2 is delivered by ValueMentor with a TrustCB Letter of Validation and includes $500 toward the TrustCB certification fee.
| AL2 term | Secusy | TAC Security |
|---|---|---|
| Price | $5,400 per application | $5,400 per application |
| Timing | 10–14 business days to draft report, then 2–3 business days after a clean retest | 2–4 weeks assessment to LoV |
| Retests | 2 included, then $300 each | Unlimited |
If Google has assigned AL2 and you expect a long remediation cycle, unlimited retests may matter more than anything else in that table.
How do you choose a plan?
Choose by how much of the work your team wants to do, not by the lowest price. The scan and questionnaire requirements are the same on every plan.
- Basic ($499): your developers can complete the questionnaire and supply authenticated Burp Suite or OWASP ZAP evidence, and the codebase is reasonably clean.
- Advanced ($599): you expect to fix findings in several rounds and want unlimited rescans and priority support.
- Fully Managed ($3,000): nobody on your team has time, and you want analysts to run the assessment.
When you're ready, choose your plan and get an instant quote. For a first pass on the questionnaire, read our AL1 guide.
What are the common pitfalls with CASA verification?
Most delays come from preparation, not from the lab. These are the mistakes we see most often:
- Buying the wrong level. Don't buy AL1 because it is cheaper if Google assigned AL2. The LoV has to match the level in Google's notification.
- Unauthenticated scans. A scan that never logs in misses most of your endpoints and will be rejected.
- Counting only the sticker price. Retest fees, certification-body fees and taxes change the real total. Basic AL1 retests beyond the second cost $75 each at Secusy.
- Treating the LoV as guaranteed. Paying for an assessment doesn't guarantee a result at any lab. Findings tied to high-likelihood CWEs must be fixed before validation. Secusy issues LoVs in the format Google Trust and Safety accepts, but acceptance follows from clean evidence.
- Forgetting renewal. Reassessment is required every 12 months. Basic renews at the same price, and Advanced and Fully Managed renew at a discount.
Which CASA plan should you choose?
If Google assigned AL1, the lower price, the published SLAs and the portal tracking make Secusy the practical choice for a startup. If Google assigned AL2, compare retest terms and timing, because the price is identical. Either way, confirm your assigned level first.
Choose your plan: CASA AL1 or CASA AL2.
Frequently asked questions
What is a CASA security assessment?
A CASA security assessment is the App Defense Alliance's Cloud Application Security Assessment. Google requires it for applications that request restricted OAuth scopes. An authorized lab validates your security evidence, or tests the app directly at AL2, and issues a Letter of Validation that you submit to Google.
How much does a CASA security assessment cost?
At Secusy, CASA AL1 is $499 (Basic), $599 (Advanced) or $3,000 (Fully Managed), one-time per application. CASA AL2 is $5,400 per application. Prices exclude applicable taxes. Google assigns your level, so confirm AL1 or AL2 before you buy.
How fast can I get a CASA Letter of Validation?
Once your questionnaire and scan evidence are clean, Secusy processes AL1 in 2–5 business days, with a 2–3 business day submission-response SLA. First-time applicants should plan 1–5 weeks end to end, because remediation time is the main variable and is not covered by any lab SLA.
Frequently asked questions
What is a CASA security assessment?
A CASA security assessment is the App Defense Alliance's Cloud Application Security Assessment. Google requires it for applications that request restricted OAuth scopes. An authorized lab validates your security evidence, or tests the app directly at AL2, and issues a Letter of Validation that you submit to Google.
How much does a CASA security assessment cost?
At Secusy, CASA AL1 is $499 (Basic), $599 (Advanced) or $3,000 (Fully Managed), one-time per application. CASA AL2 is $5,400 per application. Prices exclude applicable taxes. Google assigns your level, so confirm AL1 or AL2 before you buy.
How fast can I get a CASA Letter of Validation?
Once your questionnaire and scan evidence are clean, Secusy processes AL1 in 2–5 business days, with a 2–3 business day submission-response SLA. First-time applicants should plan 1–5 weeks end to end, because remediation time is the main variable and is not covered by any lab SLA.