"It's gone through an extensive security review from Google's side to be allowed to use that API at a high volume."

Every app that has access to the Gmail API has been through this process including Inbox Zero. But I agree that you can have more trust in products that have been on the market for longer.

The safest way to run the app is to self-host but I agree that's a hassle for most to do.