Security & Compliance

CASA Tier 2 assessment hub for FiBuKI.

Document set version 2.0 · Last updated 2026-06-21

Application

FiBuKI — https://fibuki.com

Operator

Infinity Vertigo GmbH

Registered address

Bergwald 43, 2812 Hollenthon, Austria

Company registration

FN571837m (Austrian Commercial Register)

VAT ID

ATU77919424

Restricted scope

gmail.readonly (CASA Tier 2 in progress)

Google OAuth Scopes

https://www.googleapis.com/auth/gmail.readonlyRestricted

Used to search the user's mailbox for invoice attachments and download those the user selects. Full justification and minimum-scope analysis in the OAuth Scope Justification document below.

https://www.googleapis.com/auth/userinfo.emailNon-sensitive

Identify and display the connected Gmail account in the integration settings.

https://www.googleapis.com/auth/userinfo.profileNon-sensitive

Display the user's name in the integration settings for account identification.

Google API Limited Use Disclosure

FiBuKI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we:

Only use Gmail data for the email-search and attachment-download features the user initiated.
Do not use Gmail data for advertising purposes.
Do not transfer Gmail data to third parties except as strictly necessary to provide the service.
Do not use Gmail data for training AI/ML models unrelated to the user's direct benefit.
Allow users to delete their Gmail-derived data at any time.
Humans do not access user mail except for security or legal purposes, or with explicit consent.

Assessment Artifacts

The CASA Tier 2 documentation set is maintained as markdown in the public source repository so changes are version-controlled and reviewable. Click through to read each document.

Security Architecture

Trust boundaries, authentication flows, data-protection layers, monitoring.

PII Data Flow

Entry points, storage locations, access matrix, egress, retention summary.

OAuth Scope Justification

Why gmail.readonly, minimum-scope argument, runtime minimisation, Limited Use compliance.

Data Retention Policy

Retention table per data class, deletion procedures, backup rollover.

Tier 2 Checklist (ASVS v4.0)

Per-control status (MET / PARTIAL / N-A / TODO) with evidence pointers.

Self-Assessment Questionnaire

Responses to the 54 CASA Tier 2 non-functional control questions.

SAST Remediation Report

Static-analysis findings, fixes, and re-scan evidence.

DAST Remediation Report

OWASP ZAP and Fluid Attacks dynamic-scan findings and remediation.

Companion Documents

Privacy Policy

GDPR-compliant policy, subprocessor list, user rights.

Terms of Service

Contractual terms, Austrian law, limitation of liability.

Impressum

Austrian commercial-register information, operator contact.

security.txt

RFC 9116 vulnerability disclosure contact.

Security Contact

Company: Infinity Vertigo GmbH

Address: Bergwald 43, 2812 Hollenthon, Austria

Email: hello@fibuki.com (subject prefix [Security])

Coordinated-disclosure policy: SECURITY.md

Document History

Version	Date	Changes
1.0	January 2026	Initial single-page documentation.
2.0	June 2026	Split into eight standalone artifacts per CASA Tier 2 best practice; this page is now the hub.