Patriot Mail: an AI email client through CASA Tier 2 and onto the App Store
- The problem
- A greenfield AIânative email client for web, iOS and macOS, built at Sanddev, needed Googleâs CASA Tier 2 security assessment before it could read Gmail, and it had to work for older people.
- What IÂ did
- IÂ was the principal engineer at Sanddev. IÂ wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
- Result
- I led CASA Tier 2 to a pass in January 2026, with third-party pentest findings fixed, and led the yearly reassessment, validated in October 2026; the questionnaire turned into a check on every PR. Live on the App Store on iOS and macOS since April 2026. Text scaling to 200% and a calmâemail mode shipped for older users. At that reassessment five items came back for missing evidence; I fixed the code first, then resubmitted updated evidence, and all five were accepted on 27 October.
See also: SaaS & MVP · Mobile & desktop apps




