Google Workspace
Ship Google today. Store nothing.
Truto’s Google OAuth app is CASA Tier 2 verified and live in production. Your users connect through it — no verification of your own, no unverified-app warnings, no user caps. And unlike Nylas and other sync-and-cache providers, Truto is real-time pass-through: your customers’ Gmail, Calendar, and Drive data is never stored on our platform.
SOC 2 Type II
ISO 27001
GDPR
HIPAAThe problem
Google’s Front Door Is Locked
Restricted scopes need CASA
Gmail and Drive scopes such as gmail.readonly and drive.readonly are restricted. Google requires a Cloud Application Security Assessment by an approved third-party lab before you can use them in production. Budget four to eight weeks and a four-figure fee.
Unverified means capped
Until your app clears review, your users see Google’s unverified-app warning screen and you run into user caps. That is not something you can ship an enterprise pilot on, and it is the first thing a security-conscious IT admin will refuse.
And then again, every year
CASA is not one-and-done. Apps must be reverified and complete a new security assessment at least every twelve months after the assessor’s Letter of Assessment date — a recurring cost and a recurring engineering interrupt, forever.
The solution
One Verified App. Eight Surfaces.
Truto cleared CASA Tier 2 with TAC Security and Google — architecture and data-flow review, OAuth and token handling, infrastructure controls, least-privilege design, and incident response. Every scope maps to a concrete unified API feature, read-only wherever possible.
Gmail
Read messages and attachments, organise folders and labels, and manage mailbox state.
Google Calendar
Calendars, events, contacts, and computed availability for scheduling.
Google Drive
Drives, files, folders, permissions, tags, comments, and version history.
Google Docs
Pages and page content, mapped to the Unified Knowledge Base API.
Google Contacts
Contact records, including the “other contacts” a user has interacted with.
Google Forms
Form structure, fields, and responses for intake and survey workflows.
Google Meet
Meetings, attendees, and transcripts for conversational intelligence.
Admin Directory
Users, groups, roles, and role assignments for access reviews and audits.
Why this matters
Truto never stores your customers’ email.
Most communications APIs are sync-and-cache. They pull your customers’ mail and calendar into their own database and serve your reads from that copy. It is faster to build and it is a permanent liability: their name goes in your DPA as a sub-processor, and every enterprise security review becomes a conversation about someone else’s database holding your customers’ inbox.
Truto is real-time pass-through. A request from your backend goes to Google and the response comes back to you. Nothing is cached, nothing is retained, and there is no copy of your customers’ data on our platform to breach, subpoena, or explain.
The fastest security review is the one where the answer is “we don’t store it.”
Coverage
Ten Unified APIs, One Connection
One connection maps to ten unified models, so the same request shape works across Google and every other app in its category.
/unified/emails/unified/calendar/unified/file-storage/unified/knowledge-base/unified/forms/unified/conferencing/unified/user-directory/unified/hris/unified/sso/unified/searchAnything the unified model does not express, the proxy API passes straight through to the raw Google endpoint. See the full Google connector reference.
Developer experience
One Call. Real-Time Data.
Every unified, proxy, and custom call takes the same account ID and the same bearer token. The auth, pagination, and error shape never change.
# List a connected user's Gmail messages
curl 'https://api.truto.one/unified/emails/emails?integrated_account_id=YOUR_ACCOUNT_ID' \
-H 'Authorization: Bearer TRUTO_API_TOKEN'
Swap the path for /unified/calendar/events or /unified/file-storage/files and everything else stays identical. Truto refreshes OAuth tokens before they expire, so a stale token never reaches your code, and rate-limit headers are normalised rather than hidden behind silent retries. Full reference in the docs.
AI agents
MCP-Ready From The Same Connection
The same connection exposes 110+ MCP-ready tools. Create a scoped server with one API call, then paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible framework.
Tools, not plumbing
Agents call Google tools directly instead of you writing a function-calling shim per endpoint. As the integration evolves, the tool list stays current without maintenance on your side.
Scoped access
Each MCP server URL encodes exactly which tools and methods the model may reach. Give an agent read-only Drive and nothing else, and time-limit the server if you want it to expire.
Still nothing stored
Tool calls execute against the live Google API. Your agent reads real-time data and Truto retains none of it — the same pass-through guarantee that applies to the REST APIs.
Browse the full tool list on the Google connector page.
Compare
Three Ways To Ship Google
Nylas and Truto both remove the CASA burden, so the decision comes down to where your customers’ data lives, how much of Google you can reach, and what happens when you want to leave.
Pricing is not compared here because the shapes differ: Nylas bills per connected account on top of a base fee, Truto bills $10 per active connection with the CASA assessment included. Model both against your own connection count.
Switching
Coming From Nylas
Nylas bundles email, calendar, and contacts behind one grant per user, and it is still a fair fit if that bundle is exactly your product. If you are re-evaluating, three things tend to push teams to look.
Your DPA gets shorter
A sync-and-cache vendor holds a copy of your customers’ mail and calendar, which makes them a named sub-processor and a standing question in every enterprise security review. Truto stores nothing, so that section of the review simply ends.
No forced rewrites
The v2→v3 transition made teams rewrite auth flows, remap payloads, and re-verify webhook signatures — work that bought them no new features. Truto has no equivalent cliff, and mapping changes are configuration rather than a migration.
More than the inbox
Mail, calendar, and contacts stop being enough the moment a customer asks for Drive files, Docs content, Meet transcripts, or an Admin Directory access review. All of it runs through the same verified connection here.
How it works
Live In Three Steps
Connect your users
Embed Truto Link or send users to the hosted consent screen. They see a standard Google prompt from a verified app — no warning interstitial, no user cap.
Call the unified API
One request shape across Gmail, Calendar, Drive, Docs, Forms, Meet, and Admin Directory. Truto handles token refresh, rate limits, and pagination.
Bring your own app when ready
If you later complete your own CASA assessment, add your client ID and secret. Tokens stay valid and your customers are never asked to reconnect.
Pricing
Simple Pricing. No Surprises.
One price per active connection, with the CASA Tier 2 assessment and its annual renewal included.
Google is priced per connection because Truto carries the CASA Tier 2 assessment and its annual renewal on your behalf. Everything else on the platform stays on flat per-connector pricing.
Talk to usOnly active connections are billable. Enterprise volume pricing available.
What’s included
- CASA Tier 2 verified Google OAuth app
- All eight Google surfaces, ten unified models
- Unlimited API calls
- Zero data storage — real-time pass-through
- 110+ MCP tools for AI agents
- Custom field mapping with JSONata
- Direct Slack access to Truto engineering
- Bring your own OAuth app at any time
FAQ
Common Questions
What is the Google CASA assessment?
CASA (Cloud Application Security Assessment) is the security review Google requires before an app can use restricted scopes such as gmail.readonly or drive.readonly in production. It is carried out by an approved third-party lab. Budget four to eight weeks and a four-figure fee, and note that apps must be reverified at least every twelve months after the assessor’s Letter of Assessment date.
Do I need my own CASA assessment to use Truto?
No. Truto’s Google OAuth app has cleared CASA Tier 2 and is live in production. Your users authorise through Truto’s verified app, so you get restricted-scope access without running an assessment, and without your users seeing Google’s unverified-app warning or hitting user caps.
Which Google products does Truto support?
The assessment covers eight surfaces: Gmail, Google Calendar, Google Drive, Google Docs, Google Contacts, Google Forms, Google Meet, and Admin Directory. They are exposed through ten unified models — Emails, Calendar, File Storage, Knowledge Base, Forms, Conferencing, User Directory, HRIS, Single Sign-On, and Search — plus the proxy API for raw Google endpoints.
Does Truto store my customers’ Google data?
No. Truto is real-time pass-through: your request goes to Google and the response comes back to you. Nothing is cached or retained on Truto’s platform, so there is no copy of your customers’ mail, files, or calendar to appear in a security review.
How is this different from a sync-and-cache provider?
Sync-and-cache vendors copy your customers’ mail and calendar into their own database and serve reads from that copy, which makes them a sub-processor in your DPA. Truto stores nothing. You also keep an exit: because you can move to your own OAuth app, you are not locked to tokens bound to a vendor’s client ID.
Can I use my own Google OAuth app later?
Yes. Once you complete your own CASA assessment, add your client ID and secret in Truto. Existing connections keep working, so no customer is asked to reconnect.
How much does the Google integration cost?
Google is $10 per connection per month, which covers the CASA Tier 2 assessment and its annual renewal, unlimited API calls, and MCP access. Only active connections are billable. The rest of the Truto platform is priced per connector — see the pricing page.
Can AI agents use this connection?
Yes. The same connection exposes 110+ MCP-ready tools for Google. You create a scoped MCP server with one API call and paste the URL into Claude, ChatGPT, Cursor, or any MCP-compatible framework. Each server can be restricted to read-only, to specific methods, or to tagged tool groups.
How does Truto compare to Nylas for Google?
Both remove the CASA burden, so the decision comes down to architecture and scope. Nylas is hybrid sync-and-cache: synced data is stored on their platform, which makes them a sub-processor in your DPA. Truto stores nothing. Nylas covers email, calendar, and contacts; Truto covers eight Google surfaces including Drive, Docs, Forms, Meet, and Admin Directory. Nylas also forced a v2 to v3 migration that replaced its account-and-token model with Grants, requiring new auth endpoints, refactored data models, new webhook signature logic, and end-user re-authentication.
Can I migrate to Truto from Nylas without my customers reconnecting?
Only if your tokens are bound to your own OAuth client. Tokens issued under a vendor’s client ID cannot be moved, so leaving that vendor means re-authenticating your users. This is the main argument for owning your OAuth apps — and why Truto lets you bring your own Google OAuth app at any time, so you are never in that position again.
Ship Google Without the Assessment
Truto’s CASA Tier 2 verified OAuth app is live. Connect Gmail, Calendar, Drive, and Admin Directory today — and store none of it.