gmail api - Exemption for the Google Security Assesment when using restricted scope

Question

I'm trying to find out how I can know if my application that wants to use a restricted Google API scope is exempt from the security assesment.

The documentation for the Google API Services User Data Policy states that:

Local client applications that only allow user- configured transmissions of Restricted Scope data from the device may be exempt from this requirement.

How can I find out if my app qualifies for this exemption?

question from:https://stackoverflow.com/questions/65884238/exemption-for-the-google-security-assesment-when-using-restricted-scope

Answer 1

If you check the OAuth API verification article here:

These applications [local client applications] may be exempt from the secure handling policy because the security assessment (and successful securement of a Letter of Assessment) primarily addresses risks associated with developers obtaining and storing data on servers.

Developers should specify in the verification application whether they believe the application is a local client application, and we will work with the developer to verify that is the case.

Therefore, when sending the verification application you should mention that the application you have is a local client one and if this is indeed the situation, you will be notified about it.

Also, please bear mind, that the local client applications can be defined as, according to Google:

Local client applications are generally applications that only run, store, and process data on the user's device (like a computer, mobile phone, or tablet). While user actions may cause data to leave a device (such as sending an email), local client applications do not transmit restricted scope data to the developer's servers (or servers specified by the developer), unless the user explicitly configured the application to do so. This would include local email clients, file managers, and calendar and contact management applications that don't utilize cloud services or only transmit restricted scope data to user-configured destinations.

Applications that send restricted scope data to a developer's or third-party's servers without explicit user-initiated action, such as setting up a backup capability, will not be considered a local client.

Reference

• OAuth API Verification FAQs.