Security
Marketing software touches your website, your social accounts and your ad budget. Here is how we protect all three.
Your data stays yours
- Every request is checked against your organization on the server; another customer’s data is never reachable by changing an address.
- Client logins see only the workspaces they are invited to.
- Deleting your organization deletes its data.
Your connected accounts
- Access tokens are encrypted at rest and never sent to your browser.
- Disconnecting an account deletes its tokens.
- Nothing is posted, sent or launched without an approval.
Your money
- Ad launches and resumes always need approval; daily and monthly ceilings are enforced; a kill switch pauses every campaign at once.
- Payments are handled by Stripe. We never see or store card numbers.
- Credit packs are only added when the amount charged matches the pack.
Your team
- Eight roles, from Owner to Viewer, decide who can draft, publish, spend and approve.
- An audit log records who changed what and when.
- When our support team needs to look at your account, it is a time-limited session that requires a reason and appears in your audit log.
The basics, done properly
- Passwords hashed with Argon2id; sign-in attempts are rate-limited and accounts lock after repeated failures.
- Requests from other websites are refused; pages cannot be framed by other sites.
- Website addresses you give us are checked so they cannot reach internal systems; uploaded files are identified by their contents.
Reporting a vulnerability
Found a security issue? Please contact us with the topic “Security”. We will reply and keep you informed. Contact us