Security
Security & data handling
This page is maintained by AdStrategy AI to answer common security and privacy questions about the product. It describes controls currently enabled in the app, it is not an independent certification.
Security is a shared responsibility: we operate the platform controls below, and you control your own Meta Ads Manager, Facebook Page permissions, Shopify store settings, and who you invite into your brand workspace.
Authentication
Email/password and Google sign-in via our managed backend. Sessions use rotating JWTs; password resets go through a signed one-time link.
Per-brand data isolation
Every brand is a separate workspace enforced with row-level security. Users only see the brands they are members of; social/ad connections are scoped to a single brand.
OAuth tokens & secrets
Meta, Instagram, Google Ads and Shopify tokens are readable only by server-side code. The database revokes column access from every client role, so tokens cannot reach the browser even through a direct query, and the UI never returns one. API keys and share-link passwords are stored only as hashes.
Least-privilege roles
Admin capabilities live in a dedicated user_roles table checked by a security-definer function, never inferred from a client-side flag.
Approve-first Meta push
Campaigns are created in your own Meta Ads Manager in a paused state. AdStrategy AI never turns spend on for you, you always click launch.
Compliance scans
Generated ads are scanned for Meta policy risks such as health claims, restricted categories and prohibited language, and flagged for you to resolve. The scan is advisory and does not block publishing.
Data you give us
- Account: your email and, optionally, name and avatar.
- Brand: the website URL you paste; scanned content is stored as your brand profile.
- Integrations you connect (Meta, Google Ads, Google Analytics, Shopify, Slack): the tokens and scoped account IDs you authorize.
- Content you generate in the app (strategies, ads, images, plans, posts).
Where the data lives
Data is stored in our managed backend hosted on cloud infrastructure with encryption in transit (TLS) and at rest. Access is scoped by row-level security and enforced per authenticated user.
Deleting your data
You can request full deletion at any time. See the data deletion page for the process and timing.
Reporting a security issue
Please email security@adstrategyai.com with details. We prioritize reports and will respond as quickly as we can.