Security & Data Protection

How We Protect Your Advertising Data

ADSOS is built on a defense-in-depth architecture designed to secure customer credentials, isolate organization data, and guarantee verifiable financial execution across advertising networks.

Database-Level Separation

Your data is kept separate from every other business, enforced by the database itself so no other customer can query your records.

Encrypted Connections

Your ad account connections are stored encrypted on secure servers, and raw access tokens are never exposed to the browser.

Tamper-Proof History

Every financial calculation and budget adjustment produces an unchangeable record, so you can always see who did what.

Verified Technical Safeguards

Precise technical mechanisms protecting client data and transactions across the platform.

Multi-Tenant Row Level Security (RLS)

Your data is kept separate from every other business, enforced by the database itself.

Every table in the PostgreSQL database enforces strict Row Level Security (RLS) policies based on the authenticated user's workspace tenant ID. Cross-tenant reads and mutations are denied at the database engine level, ensuring that application code bugs cannot leak records between organizations.

Enforcement: PostgreSQL RLS policies in supabase/migrations/20261012000000_core_schema.sql

AES-256-GCM Token Encryption at Rest

Your ad account connections are stored encrypted.

Third-party OAuth access and refresh tokens from Meta, Google, TikTok, X, and Pinterest are encrypted before storage using authenticated AES-256-GCM encryption. Each encrypted payload contains an initialization vector (IV) and a 128-bit authentication tag to prevent ciphertext tampering. Decrypted tokens are never sent to the client browser.

Enforcement: Authenticated cryptography in src/lib/security/token-crypto.ts

Immutable Spend & Action Audit Records

Every change is recorded and can't be edited afterwards, so you can always see who did what.

Financial calculations, spend synchronization events, and campaign status mutations are written to append-only audit tables. Historical spend synchronization snapshots and billing fee deductions cannot be modified or retroactively altered.

Enforcement: Append-only ledger in src/lib/actions/spend.ts

Cryptographic Webhook Signature Verification

We cryptographically verify every payment notification before crediting transactions.

Inbound webhooks from Paystack (HMAC-SHA512) and Flutterwave (secret hash verification) are validated before processing. Unsigned, spoofed, or replayed webhooks are rejected immediately with HTTP 401.

Enforcement: Webhook handlers in src/app/api/webhooks/paystack/route.ts and src/app/api/webhooks/flutterwave/route.ts

Deterministic Financial Calculations (Zero Floating-Point)

Fees are calculated by fixed rules, never by AI.

Platform usage fees (10%) are calculated in integer minor currency units (cents, kobo, pesewas) using deterministic half-up rounding. Financial calculations run exclusively in verified application code and are strictly isolated from the AI inference engine.

Enforcement: Minor unit arithmetic in src/lib/billing/fee.ts

Human-in-the-Loop AI Guardrails

AI only provides recommendations; it cannot move money or publish ads without your confirmation.

Google Gemini is restricted to read-only campaign analysis, creative suggestions, and performance explanations. The AI layer has no database mutation privileges for live budgets, cannot execute payment checkouts, and cannot publish campaigns autonomously.

Enforcement: Architectural boundary in src/lib/campaigns/platform-services.ts

Have security questions or need compliance documentation?

Our engineering team is available for security reviews and vendor assessments.

Contact Security Team