Security at Adsperty

Adsperty holds credentials to real ad accounts and moves real money on your behalf. That responsibility shapes every layer of the product.

Your ad-platform credentials

OAuth tokens are encrypted at rest with a dedicated key, separate from the application key, using envelope encryption with per-secret data keys. Tokens are decrypted only inside the connection layer at the moment an API call is made, they never appear in logs, browser payloads, AI prompts, or exports. Disconnecting a platform wipes the token material immediately.

Tenant isolation

Every row of your data carries your workspace identity, enforced in four independent layers: database scopes, authorization policies, request binding, and re-verification inside background jobs. Cross-tenant access attempts return "not found", the system does not even confirm another workspace exists. These isolation tests block every release.

No mutation without a paper trail

Every change to your ad accounts (human or AI) flows through one pipeline: proposal, policy check, approval where required, execution, read-back verification against the platform, audit entry. Audit records are append-only at the database level; not even the application can rewrite history.

Account security

Passwords are hashed with argon2id. TOTP two-factor authentication is available for everyone and required for Owners and Admins before Autopilot can be armed. Sensitive changes (autonomy modes, spending guardrails, releasing an emergency stop) demand a fresh identity proof even inside a signed-in session, and notify the other admins.

Operations

Traffic is TLS-only (rated A+ by SSL Labs), security headers are enforced, dependencies are scanned continuously, and the database is backed up nightly off-site with restore drills. Found a vulnerability? Email support@adsperty.com, security reports get priority handling.