Security & Trust
Security at Habiata
Independent verification, transparent Google API handling, and the controls we apply to protect agency and client data.
Google OAuth app verification
Habiata has completed CASA Tier 2 (Cloud Application Security Assessment) for its use of Google OAuth and restricted Google API scopes, including Gmail and Google Calendar integration.
CASA Tier 2 is an independent assessment by a Google-authorized lab under the App Defense Alliance. It validates that our application meets security requirements for handling Google user data, particularly OAuth token management, encryption, and scope-limited access.
Verified May 2026 · CASA Tier 2 overview
CASA Tier 2 is scoped to the assessment requirements for Google API integrations. It is not equivalent to SOC 2 Type II or ISO 27001.
Google OAuth & API data
When you connect Gmail or Google Calendar, Habiata accesses only the scopes needed for the features you use. We comply with the Google API Services User Data Policy, including Limited Use requirements.
No use of Google data for advertising
No transfer of Google data to third parties except as required to provide requested features
No use of Google data to train general-purpose AI models
OAuth tokens handled server-side; disconnect revokes access at Google
Platform security controls
EU data hosting with encryption in transit (TLS 1.2+) and at rest
PostgreSQL row-level security on user-facing data tables
OAuth refresh tokens encrypted server-side; Google access tokens are not persisted in the browser
Automated SAST (CodeQL) and DAST (OWASP ZAP) scans in CI
Strict Content-Security-Policy and security headers on all distributions
Role-based access controls scoped to company and workspace membership
Letter of Validation
Our CASA Tier 2 Letter of Validation (LOV) is available under NDA on request for procurement, security reviews, and enterprise due diligence.
legal@habiata.lu