3 ms·
> The third party audit is not required for email clients that run on end users computers and store credentials locally. It might not be required for applicati
by Alex3917 4y ago
> The third party audit is not required for email clients that run on end users computers and store credentials locally.
It might not be required for applications that run locally, but they don't tell you whether or not it will be required until after you've already done the work to create the app.
The exact wording from the FAQ is:
"Local Data Storage: Local client applications don't need to undergo a security assessment because data is run, stored, and processed only on the user's device. Local client applications that only allow user- configured transmissions of Restricted Scope data from the device may be exempt from this requirement."
Keep in mind that any email client that allows you to reply to (or forward) an email would count as transmitting restricted scope data from the user's device.
- joshuamorton 4y ago> Keep in mind that any email client that allows you to reply to (or forward) an email would count as transmitting restricted scope data from the user's device. Not if it does so only via the oauth api?
- Fizzadar 4y agoThe OAuth verification FAQs state: > Ensure your app complies with the Google APIs Terms of Service, Google's API Services User Data Policy, and the Additional Requirements for Specific Scopes, which includes undergoing an annual security assessment if your app accesses restricted scope Google users data from or through a third-party server. In the case of an email client data is transmitted directly from/to Google's own IMAP/SMTP servers and not a third party, and is thus exempt from the assessment.