Skip to main content

Beta-tester help

Google's “unverified connection” screen

During the private beta, when you connect your Gmail to Bostaji for the first time, Google shows you a caution screen. This is normal, it is temporary, and here is what to do.

In one sentence

Google verifies every application that connects to Gmail. Bostaji is currently being verified (a standard procedure, several weeks). In the meantime, the caution screen asks you to confirm that you trust us — it is up to you to click to continue.

Why this screen appears

Google shows this screen for any application not yet verified by its teams, even a legitimate one. It is a protection against fake applications that would try to connect to your account without your conscious consent. Until Bostaji has completed the verification procedure (Production verified + independent CASA Tier 2 audit by a laboratory recognised by Google), the screen stays visible.

It is not a sign that Bostaji is dangerous. Every application goes through this screen before obtaining its verification. Verification happens before the public opening of the service.

Step by step

  1. 1. You launch Bostaji for the first time.

    On startup, Bostaji asks you to connect your Gmail mailbox. You click “Connect Gmail” in the application.

    [SCREENSHOT — the app's “Connect Gmail” button — to be added]

  2. 2. A Google window opens.

    Your browser opens on a Google page. You choose the Gmail account you want to connect.

    [SCREENSHOT — Google's “Choose an account” page — to be added]

  3. 3. Google shows the caution screen.

    This is the screen that can be surprising:

    [SCREENSHOT — the “This app isn't verified by Google” screen — to be added]

    The text shown is something like: “Google hasn't verified this app. You should only continue if you know and trust the developer.” You also see an “Advanced” link at the bottom.

  4. 4. Click “Advanced”.

    The link is small and discreet, at the bottom left of the screen. Clicking it reveals a new option.

    [SCREENSHOT — the option revealed after clicking “Advanced” — to be added]

  5. 5. Click “Go to Bostaji (unsafe)”.

    This option appears once “Advanced” is expanded. The “(unsafe)” wording is there because verification is not done — not because there is a security problem on our side. Click to continue.

    [SCREENSHOT — the “Go to Bostaji (unsafe)” link — to be added]

  6. 6. You reach the permissions screen.

    Google lists the permissions Bostaji requests on your Gmail. You read them and you validate. The exact list (and why each permission is requested) is explained in section 7 of our privacy policy.

    [SCREENSHOT — Google's permissions screen “Bostaji wants to access your Google Account” — to be added]

  7. 7. Click “Allow”.

    Once allowed, you are redirected to the Bostaji app, which takes over. The connection is done, and you will not have to go through this screen again.

What makes this step safe

  • You invited us. You reach this page because you are a Bostaji beta tester and we sent you the installation link directly. You know what our name and our site look like.
  • The Google URL stays a Google URL. Check that you are indeed on accounts.google.com when you grant your permissions, not on a site imitating Google.
  • The name shown is Bostaji. On the permissions screen, Google clearly states the name of the application requesting access. If that name is not Bostaji, do not allow it.
  • You stay in control at all times. You can revoke Bostaji's access at any time from your Google Account settings, with no action needed on our side.

Why this whole path, and until when

For an application accessing Gmail to show a connection screen without this caution notice, Google asks for two things: verification of the domain and of the publisher's identity (the Production verified procedure), and an independent security audit carried out by a recognised laboratory (CASA Tier 2). Both are under way.

Until these two steps are complete, the screen stays visible on each new connection. Once complete (which will happen before the public opening of the service), the screen disappears automatically and the connection becomes identical to that of any mainstream Google application.

A question, or stuck at step 3, 4 or 5? Write to us, we get back to you quickly. Connecting an Outlook / Microsoft mailbox instead? See the Outlook help. A Yahoo, Orange or other mailbox? See the IMAP help.