Google CASA AL1 for Desktop Apps & Letter of Validation (LoV)

Basic starts at $599 with 2 retests included. Advanced is $799 and includes unlimited rescans until LoV is issued. Fully Managed is $3,000 and includes a full assessment in addition to unlimited rescans until LoV. Pricing excludes applicable taxes (VAT, withholding tax, as applicable to your billing country).

Desktop applications are a different assessment scope from web and SaaS apps. The Letter of Validation is the same Google-accepted AL1 LoV, but desktop work is quoted on its own price list. If you need CASA AL1 for a web app or SaaS product, use the web CASA AL1 page.

Google assigns the required level based on your app's OAuth scopes when you submit for its annual security assessment. AL1 and AL2 differ in assessment process, not in the scope that gets covered — whichever level Google assigns is what we assess against.

The assessment, the signed Letter of Validation (LoV), and submission of that LoV to Google's Third Party Data Safety team. There is no separate certification-body fee. Taxes are excluded and billed as applicable to your billing country.

Basic includes 2 retests; additional retests are $75 each. Advanced and Fully Managed include unlimited rescans until you reach a clean validation result.

Once your Self-Assessment Questionnaire and scan evidence are complete and clean, processing takes 2–5 business days. This excludes time spent on your own remediation. Submission response SLA is 3 business days on Basic and 2 business days on Advanced and Fully Managed. For a first-time submission — including evidence preparation and any remediation cycles — plan for 1–5 weeks end to end.

To get started, we need:

• Google's assessment/assignment notice
• Your Google Cloud project number and OAuth Client ID(s)
• Desktop application details (platforms in scope, installer or build access)
• An architecture / data-flow overview, including any third-party data processors (e.g., AI providers your app sends Google-sourced data to)
• A completed Self-Assessment Questionnaire, via the Secusy portal
• Authenticated scan evidence covering the desktop app and its OAuth integration
• Test account access, provisioned through the customer portal

The questionnaire and the scan evidence are independent tracks — you can work on both at the same time rather than completing one before starting the other.

Validation is performed against production. If you use a production-identical staging environment for any invasive testing, that's acceptable — the lab review step validates against production.

Yes. ValueMentor is an App Defense Alliance–authorized lab for CASA, and the LoV is issued by ValueMentor, consistent with the ADA authorized-labs listing.

ValueMentor submits the signed LoV directly to Google's Third Party Data Safety team; additionally, you may forward it yourself if requested.

12 months, after which reassessment is required. Renewal on Basic is at the same price; Advanced and Fully Managed renewals carry a 10% discount.