Google CASA Assessment Cost: Pricing for AL1 and AL2 in 2026
How much does a Google CASA assessment cost?
A Google CASA assessment costs between $499 and $5,400 per application at Secusy, depending on the assurance level Google assigns. CASA AL1 (also called Tier 2) is $499 for Basic, $599 for Advanced or $3,000 for Fully Managed. CASA AL2 (Tier 3) is a flat $5,400. Every price is one-time, per application / OAuth Client ID, includes the signed Letter of Validation (LoV), and excludes applicable taxes.
The level isn't something you pick. Google decides whether your app needs AL1 or AL2 based on the OAuth scopes it requests, so the first step in budgeting is reading your CASA notice.
CASA AL1 vs AL2 price comparison
Here is every published CASA price side by side, with the terms that actually change your total.
| AL1 Basic | AL1 Advanced | AL1 Fully Managed | AL2 | |
|---|---|---|---|---|
| Price (per app / OAuth Client ID) | $499 | $599 | $3,000 | $5,400 |
| Assessment method | Self-assessment + validated authenticated scan | Self-assessment + validated authenticated scan | Self-assessment + scan, run with ValueMentor | Manual penetration test (OWASP ASVS L2) |
| Retests / rescans | 2 included, then $75 each | Unlimited until LoV | Unlimited until LoV | 2 included within 60 days, then $300 each |
| Submission response SLA | 2 business days | 1 business day | 1 business day | Scope confirmed within 24 hours |
| Processing / delivery | 2–5 business days once evidence is clean | 2–5 business days once evidence is clean | 2–5 business days once evidence is clean | 10–14 business days to draft report |
| SAQ | You complete it | You complete it | ValueMentor coordinates and prepares | Not applicable — lab-led testing |
| Remediation support | Async email | Priority email and chat | Email, chat + up to 8 hours 1:1 triage | Full report + one debrief call |
| Letter of Validation issued by | ValueMentor | ValueMentor | ValueMentor | TrustCB |
| Certification-body fee | None | None | None | $500 included in price |
| Renewal | Same price | 10% discount | 10% discount | Same base price; 10% off multi-year from year two |
CASA AL1 pricing: what each tier buys you
All three AL1 tiers produce the same deliverable — an official signed Letter of Validation, submitted to Google's Third Party Data Safety team. What you're paying for between tiers is speed, retest headroom and how much of the work you hand over.
- Basic, $499. Built for independent developers and small teams with clean codebases. You run the authenticated Burp Suite Professional or OWASP ZAP scan (yourself or through the Secusy portal's built-in scanner) and complete the Self-Assessment Questionnaire. Two retests are included; each additional retest is $75.
- Advanced, $599. For teams that expect to clear a few CWE flags. Unlimited rescans until you get a clean validation result, a one-business-day response SLA, priority processing and priority email and chat support. For $100 more than Basic, it removes the retest meter entirely.
- Fully Managed, $3,000. ValueMentor analysts execute the scanning, coordinate and prepare the SAQ with you, and give you up to 8 hours of 1:1 expert triage, with a dedicated lead. Customer effort drops from high to low.
What's included in the CASA AL1 price
Every AL1 tier covers one web app / OAuth client ID and includes:
- Review of your Self-Assessment Questionnaire and authenticated scan evidence by an App Defense Alliance–authorized lab (ValueMentor)
- Manual coverage where standard automated scans miss a required test case — not billed as extra scope
- The signed Letter of Validation, issued by ValueMentor
- Submission of the LoV to Google's Third Party Data Safety team
- The retests or rescans of your tier
- No separate certification-body fee
Once your SAQ and scan evidence are complete and clean, processing takes 2–5 business days. For a first-time submission, including evidence preparation and remediation cycles, plan for 1–5 weeks end to end.
CASA AL2 pricing: $5,400 per application
CASA AL2 is a single, flat-fee engagement rather than a tiered one, because the work is the same every time: an authorized lab manually tests your application. It applies to apps requesting restricted OAuth scopes, such as full Gmail access or unrestricted Drive access, and it can't be satisfied with a scanner report.
The $5,400 price covers one web application / one OAuth Client ID and the APIs it authenticates against, and it includes $500 toward the TrustCB certification fee. Testing is performed by ValueMentor; the Letter of Validation is issued by TrustCB, an ADA-authorized certification body, based on ValueMentor's findings.
What's included in the CASA AL2 price
- Manual penetration test mapped to OWASP ASVS Level 2 control families: authentication, session management, access control and input handling
- IDOR/BOLA testing across tenant and role boundaries
- TLS and cipher configuration review for in-scope endpoints
- Two remediation retests, if requested within 60 days of the draft report
- A full technical report with CVSS-scored findings, proof-of-concept steps and remediation guidance
- One remediation debrief call with your engineering team
- One assigned lead engineer as point of contact
- The signed Letter of Validation from TrustCB, in the format Google Trust & Safety requires
The draft report lands 10–14 business days from kickoff, and the LoV is typically issued 2–3 business days after a clean retest. Time spent on your own remediation isn't counted in either estimate.
What CASA pricing does not include
Knowing the exclusions is how you avoid a surprise invoice.
| Not included | AL1 | AL2 |
|---|---|---|
| Taxes (VAT, withholding tax, as applicable to your billing country) | Excluded | Excluded |
| Additional applications or OAuth Client IDs | Priced per app | Priced per app |
| Extra retests | Basic: $75 each after 2 | $300 each after 2; retests after the 60-day window quoted separately |
| Infrastructure or network pentesting beyond the OAuth client | Out of scope | Out of scope |
| Fixing the vulnerabilities found | Your engineering team | Your engineering team |
| Expedited turnaround | — | By discussion |
The hidden cost of CASA: your own time
The assessment fee is the predictable part. The variable part is the engineering time your team spends getting to clean evidence, and it's often larger than the invoice.
- Preparation. Documenting architecture, OAuth flows, API URLs and data flows, including any third-party processors such as AI providers your app sends Google-sourced data to.
- The SAQ. Answering each applicable requirement with an implementation statement and evidence. Our CASA AL1 SAQ guide walks through it.
- Remediation. Fixing what the scan or the pentest finds — insecure cookies, missing CSRF protection, outdated dependencies, IDOR, exposed debug output.
- Retest cycles. Every round costs calendar time, and on AL1 Basic or after AL2's two included retests, it costs money too.
Teams with secure OAuth, solid session handling, admin MFA, secrets in a secrets manager and maintained dependencies move fastest. If your team lacks the bandwidth, Fully Managed shifts most of that effort for a predictable fee.
Can you choose a cheaper CASA level?
No. Google assigns the assurance level when it notifies you of the annual security assessment, based on the OAuth scopes your app requests. AL1 and AL2 differ in assessment process, not in the scope that gets covered — AL1 relies on your self-assessment plus validated scan evidence, while AL2 is lab-led manual testing. An AL1 Letter of Validation cannot substitute for an AL2 requirement.
The one cost lever you do control at the scope level is the scopes themselves. If your app requests restricted scopes it doesn't strictly need, narrowing them is a product decision worth discussing with your team before the next assessment cycle.
CASA renewal costs
CASA isn't a one-off purchase. The Letter of Validation is valid for 12 months, and Google requires reassessment every year, so budget for it as an annual line item.
- AL1 Basic renews at the same price, $499.
- AL1 Advanced and Fully Managed renew with a 10% discount.
- AL2 keeps the same $5,400 base price year over year, with a 10% discount on multi-year signups from the second year onward.
Year two is usually cheaper in practice even without a discount, because the architecture documentation and evidence you assembled the first time can be reused.
Worked CASA cost examples
Using the published prices above, before taxes:
| Scenario | Calculation | Total |
|---|---|---|
| One app, AL1 Basic, clean on first or second rescan | $499 | $499 |
| One app, AL1 Basic, needing three extra retests | $499 + 3 × $75 | $724 |
| One app, AL1 Advanced, any number of rescans | $599 | $599 |
| One app, AL1, fully outsourced | $3,000 | $3,000 |
| One app, AL2, fixed within two retests | $5,400 | $5,400 |
| Two apps / OAuth Client IDs, both AL2 | 2 × $5,400 | $10,800 |
| One AL1 app (Advanced) and one AL2 app | $599 + $5,400 | $5,999 |
How to keep your CASA cost down
- Read the notice first. Confirm the assurance level, the OAuth Client ID(s) in scope and the deadline before you buy anything.
- Pick the tier for your retest risk, not the sticker price. If you're unsure your first scan will be clean, AL1 Advanced caps your cost at $599.
- Fix the common findings before you scan. Secure and HttpOnly session cookies, CSRF protection, Authorization Code Flow with validated state and redirect URIs, MFA on admin consoles and no secrets in code.
- Work the SAQ and the scan in parallel. They are independent tracks, which shortens the calendar time you pay for in engineering hours.
- Remediate inside AL2's 60-day window. Retests requested later are quoted separately.
Ready to price your own assessment? Compare tiers and check out online on the CASA AL1 and CASA AL2 pages.
Frequently asked questions
How much does a Google CASA assessment cost?
At Secusy, CASA AL1 (Tier 2) costs $499 (Basic), $599 (Advanced) or $3,000 (Fully Managed), and CASA AL2 (Tier 3) costs a flat $5,400. Prices are one-time, per application / OAuth Client ID, and exclude applicable taxes.
How much does CASA AL1 cost?
$499 for Basic (two retests included, additional retests $75 each), $599 for Advanced (unlimited rescans until the Letter of Validation is issued) and $3,000 for Fully Managed (ValueMentor runs the scanning and prepares the SAQ with you). All three include the signed Letter of Validation and its submission to Google.
How much does CASA AL2 cost?
$5,400 flat per application / OAuth Client ID. That covers a manual penetration test mapped to OWASP ASVS Level 2, a full findings report, two remediation retests within 60 days of the draft report, and a signed Letter of Validation issued by TrustCB. The fee includes $500 toward the TrustCB certification fee.
Does Google charge for the CASA assessment?
The assessment fee is paid to the authorized assessor that performs the work and issues the Letter of Validation, not to Google.
Can I pay for AL1 instead of AL2 to save money?
No. Google assigns the required assurance level based on the OAuth scopes your application requests. An AL1 Letter of Validation does not satisfy an AL2 requirement.
Is there a separate certification fee on top of the CASA price?
Not for CASA AL1 at Secusy — every tier states no separate certification-body fee. For CASA AL2, the $5,400 price already includes $500 toward the TrustCB certification fee.
How much does CASA renewal cost?
The Letter of Validation is valid for 12 months. AL1 Basic renews at the same price; AL1 Advanced and Fully Managed renewals carry a 10% discount. AL2's base price is unchanged year over year, with a 10% discount on multi-year signups from the second year onward.
Do I pay once for multiple OAuth Client IDs?
No. Pricing is per application / OAuth Client ID, because each is a distinct assessment with its own Letter of Validation. Two AL2 applications cost $10,800.