MailNotes
Your Gmail processed by AI to Notion in one click
Hi everyone,
I recently finished the Google OAuth Verification process for a "Restricted Scope" app (gmail.readonly) and wanted to share the real numbers and hurdles for anyone else building on the Gmail API.
The Project: I built MailNotes because my personal workflow was too slow. I hated manually copying invoice details or client info from Gmail to Notion. I wanted an AI to do it for me and extract tasks, summaries, etc.
The Stack:
Core: Node.js / TypeScript.
AI: OpenAI GPT-4 mini (cost-effective and fast for extraction).
Privacy: This was key. I don't store any emails in a database. The AI processes them on the fly, sends the data to Notion, and the memory is wiped.
The Audit (CASA Tier 2) - The Numbers: To get access to sensitive Gmail data, you can't just click "publish". You need a third-party security audit.
Auditor: TAC Security (Google's official partner).
Cost: $540.00 (This covers the scan + 2 revalidations).
Timeline: Started Dec 5th, 2025. Approved Jan 6th, 2026. (Exactly 1 month).
Total Investment: ~$600 (Audit + Server/Domain).
The Process & Hurdles:
Pre-scan: I used OWASP ZAP to self-scan before paying. Highly recommend this.
Encryption: The audit flagged some encryption configurations. It wasn't panic-inducing, but required tweaking my Nginx/Server config.
Revalidation: You get 2 "tries" (revalidations) included in the price. I fixed the issues and passed on the 1st revalidation.
Support: Surprisingly good. I actually spoke to humans at both Google and TAC Security when I got stuck.
Current Status: I'm now officially verified (Tier 2) and launching with a Freemium model (monthly/annual sub).
If you are building a productivity tool and dreading the audit: It's doable. It costs ~$600 and takes a month, but the "Verified" badge is worth it for user trust.
Happy to answer any technical questions about the audit or the ZAP scan settings.
I'm also looking for tester so if anyone is interested let me know!
Comment