Part 1
9 min read
How Numero Prepared for Google CASA AL1
A transparent account of how Numero turned a security questionnaire into code changes, repeatable tests, and requirement-by-requirement evidence.
Read articleNumero security transparency
Numero completed its CASA AL1 security assessment.
Our assessor submitted Numero's Letter of Validation to Google in 2026. See what was assessed, what we changed, and how the controls were tested.
Assessment surface
48
Requirement rows reviewed across the declared AL1 scope.
Control areas
6
Authentication through secure configuration and operations.
Current status
Assessment completed
Letter of Validation submitted to Google in 2026.
Numero completed the CASA AL1 assessment, and the assessor submitted the Letter of Validation to Google in 2026. Google then approved Numero's read-only Gmail access, so Numero is Google certified for Gmail access. That is not an endorsement of Numero as a product.
Three-part transparency series
The assessment, the architecture, and the proof.
These articles are based on Numero's readiness review, remediation report, evidence pack, scan runbooks, and requirement-level portal artifacts.
Part 2
9 min read
How Numero Protects Access to Your Financial Data
The application controls behind least-privilege Gmail access, encrypted source credentials, revocable sessions, and metadata-only Financial Memory.
Read article
Part 3
10 min read
How Numero Tested Its CASA Security Controls
Why source code alone was not enough, how authenticated scans changed the evidence, and what a clean result does and does not prove.
Read articleAssessment timeline
Security work, not a single scan.
The evidence pack records a sequence of review, remediation, rejection, stronger proof, and retesting.
- 01
July 2026
Independent readiness review
The website and API were reviewed against the CASA Application Layer 1 questionnaire and OWASP ASVS. The review identified implementation, evidence, and external-artifact gaps.
- 02
August 2
Application remediation verified
Secret validation, key separation, revocable sessions, privacy-safe logging, data retention, deletion, rate limits, TLS checks, and security headers were fixed or strengthened.
- 03
August 15
Evidence rebuilt after reviewer feedback
Narrow or source-only submissions were replaced with complete control paths, broader scope checks, new regression tests, and live behavior evidence.
- 04
August 29-30
Authenticated scans and portal packs
Bounded OWASP ZAP plans and companion black-box scripts were run, results were reviewed, and per-requirement evidence images were prepared for portal submission or resubmission.
- 05
2026
Assessment completed
The assessor completed Numero's CASA AL1 assessment and submitted the Letter of Validation to Google.
What was reviewed
Six connected areas of application security.
01
Authentication
OAuth with PKCE, password hashing, account lockout, per-IP rate limits, and Turnstile before credential work.
02
Session management
Short-lived access, revocable refresh, Secure and HttpOnly cookies, logout revocation, and password-change invalidation.
03
Access control
User-scoped data access, protected modifications, narrow admin access, Origin checks, and secure OAuth callback validation.
04
Communications
TLS enforcement, authenticated encryption, strong cryptographic primitives, and indistinguishable failure behavior.
05
Data validation
Injection defenses, bounded file handling, fixed outbound destinations, safe redirects, and parameterized database queries.
06
Configuration
Dependency scanning, production fail-closed checks, strict headers, sanitized logs, secret management, and storage clearing.
What changed
The review changed the product.
Some findings were code defects. Others were missing validation, incomplete tests, or evidence that could not support its own claim. All deserved a concrete disposition.
- Production rejects weak secrets, known development keys, non-TLS database settings, and debug logging.
- OAuth transaction encryption was separated from source-token encryption and session signing.
- Logout now revokes both access and refresh tokens through a server-side fingerprint store.
- Restricted Gmail content, AI context, recipients, model output, and extracted fields were removed from logs.
- Permanent account deletion and a 90-day temporary evaluation-data retention limit were enforced.
- Password and support abuse controls gained rate limits; Turnstile is verified before credential work.
- The web Content Security Policy moved to per-request nonces with strict framing and resource boundaries.
- Security scanning now combines SAST, SCA, passive CI DAST, authenticated scans, and targeted scripts.
How proof was built
One claim, several independent ways to challenge it.
Source and tests
Complete control paths, commit-pinned references, and regression tests that actively try to break the asserted behavior.
Runtime verification
Authenticated OWASP ZAP plans plus focused black-box scripts for session, authorization, injection, and configuration behavior.
Sanitized evidence
Requirement-level statements and images with exact context, while excluding live tokens, customer data, secrets, and raw session history.
What this means for customer trust.
Numero's privacy claims are tied to enforceable controls: least-privilege Gmail access, encrypted source credentials, revocable sessions, user-scoped data access, content-free logs, and deletion and retention behavior.
The assessment process does not make incidents impossible. It makes the controls easier to inspect, the evidence harder to overstate, and regressions more likely to be caught by permanent tests and repeatable scans.
Frequently asked
Numero and CASA AL1.
Yes. Numero completed the CASA AL1 assessment, the assessor submitted the Letter of Validation to Google in 2026, and Google approved Numero's read-only Gmail access: Numero is Google certified for Gmail access. That approval covers Gmail access; it is not an endorsement of Numero as a product.
The documented scope covers the Numero website and API at hellonumero.com and api.hellonumero.com. The mobile application was deliberately excluded because it had not been disclosed in the assessment portal scope.
Yes. The readiness review and reviewer feedback led to changes in secret validation, key separation, session revocation, logging, data deletion and retention, rate limiting, database TLS enforcement, security headers, dependency hygiene, and regression coverage.
The August 30 Section 2, Section 5, and Section 6 authenticated runs reported zero high, medium, or low findings across their tested scopes. Section 3 retained one transparently dispositioned false positive for a token-less form whose Origin-based CSRF control was independently verified.
No. Security testing is evidence about a defined version, scope, toolset, and date. Numero continues to scan dependencies, test controls, patch findings, and refresh evidence after relevant changes.
Read the framework behind the review.
CASA is maintained by the App Defense Alliance and built on the OWASP Application Security Verification Standard.
Numero is not affiliated with or endorsed by Google, the App Defense Alliance, or TAC Security. The completed assessment covered Numero's website and API; the native mobile application was outside the declared assessment scope.