Controls
Last reviewed July 2026Infrastructure security
- AES-256 encryption for data at rest
- TLS 1.3 encryption for data in transit
- Cloudflare DDoS protection for all web traffic
- Encrypted backups with tested restore procedures
- Isolated production environment
Organizational security
- Information security policy
- Risk management program
- Internal security audits
- Personnel security and background checks
- Vendor risk assessments for all subprocessors
Product security
- Secure development life cycle
- HTTPS-only destination URL validation
- Automatic scanning for malicious ad content
- Multi-step approval workflows for campaign launches
- Budget limits and spending alerts
Access control
- Passwordless authentication
- Role-based team access management
- Privileged access management
- OAuth-scoped platform tokens, revocable at any time
Data and privacy
- Data Processing Agreement (DPA)
- Data classification and handling standards
- GDPR data subject rights support
- Breach notification per GDPR Article 33
- Sanctions compliance screening
Data collected
Customer contact details
Name, email, and workspace settings needed to run your account.
Ad account and campaign data
Campaigns, creatives, and performance data accessed through official platform APIs.
Credit card numbers
Payments are processed by Stripe — card details never touch our servers.
Personal health information
Subprocessors
View all
PlanetScale • Database
Database hosting and management. SOC 2 Type II certified, encryption at rest and in transit. (USA)
Railway • Application hosting
Application hosting in isolated container environments. SOC 2 Type II certified. (USA)
Google Cloud Platform • Cloud provider
BigQuery data warehousing and Gemini AI services. SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018 certified. (USA / EU)
Cloudflare • CDN and storage
CDN, DDoS protection, and media storage (R2). SOC 2 Type II, ISO 27001 certified. (USA)
Upstash • Caching
Redis caching services. SOC 2 Type II certified, data encrypted at rest. (USA)
Ad platforms you connect (Meta, TikTok, Google Ads, and the other channels) are integrations you authorize directly and are governed by their own terms — they are not subprocessors.