Is itogai security-verified or audited?

itogai holds App Defense Alliance CASA verification at Assurance Level 1 (formerly Tier 2), renewed annually by a new Letter of Validation: an independent assessment of the security controls behind itogai’s Google API integrations and the metadata-only handling of Gmail. itogai does not hold a SOC 2 report or an ISO/IEC 27001 certificate. Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher), and payments run through Stripe. The security policies and the control crosswalk are available to a customer under a confidentiality agreement on request to legal@itogai.com. Details: itogai.app/legal/security.