Hosting for the public

If you want to run this as a service for people outside your own team:

• you need Google OAuth app verification for restricted Gmail scopes, plus a CASA security assessment by a Google-approved lab, renewed every year;
• you need your own privacy policy and terms covering mailbox data, and you must comply with Google’s API Services User Data Policy (Limited Use);
• you need multi-tenant features such as self-signup, data deletion and billing. These are tracked in ROADMAP.md.

One exception: Google Workspace organizations can register their own Internal OAuth client and use it with a hosted instance. Internal apps don’t need verification. See Deployment models.

---

Synced from rayhu/surfski/README.md@e4c5de0. The repository is the source of truth.