Security and trust
Your campaigns, leads and ad accounts are business-critical. This is how we protect them.
Sign-in and accounts
Access starts with a verified identity.
- Password sign-in always ends with a one-time code sent to your email.
- Sign in with Google or Facebook, and link or unlink them from your account page.
- Repeated failed attempts lock the account temporarily.
- Changing your password signs you out everywhere.
- Sessions use secure, HttpOnly cookies; tokens never appear in page addresses.
Workspace isolation and roles
Each organization is a separate workspace.
- Data is scoped to your organization on every request, and cross-tenant access is covered by automated tests.
- Nine roles control who can launch, change budgets, see leads and manage members.
- Sales agents see only leads assigned to them.
Your Meta connection
We only act on what you connect.
- The connection belongs to the organization and you choose which assets it may use.
- Access tokens are stored encrypted and are never returned by the API.
- Disconnecting revokes access and keeps your own data.
Audit and support
You can see what happened.
- An audit log records sensitive actions on plans that include it.
- When our support team needs to look at your workspace, they use a read-only session that expires after 30 minutes and requires a written reason.
- Each support session is recorded in your audit log.
Payments
We never handle your card.
- Payments are processed on Paymob's hosted page.
- Payment webhooks are verified cryptographically before they are trusted.
Questions for your security team? Contact us and we will answer them.