Security statement

Summary

This statement summarises our security controls. The Security and trust page explains them in more detail, and our contractual commitments are in the Data processing addendum. We do not publish details of our infrastructure providers or architecture, because doing so would help attackers.

Infrastructure

• The service is delivered from a distributed, encrypted network across more than 125 countries, which keeps public pages close to visitors and available if one location fails.
• All traffic is encrypted in transit with current TLS and HTTP Strict Transport Security; data is encrypted at rest, including backups.
• The application sends strict security headers, including a content security policy.

Access and isolation

• Multi-factor authentication with authenticator-app codes is required for every client and staff account; single-use recovery codes are stored only as hashes.
• Each client workspace is isolated in the application and at the database layer, so one client cannot read another's data.
• Staff permissions are role-based and least-privilege; sensitive actions are recorded in append-only audit logs.
• We never ask for advertising-account passwords. We work through platform user or partner permissions that the client controls and can remove at any time.

Payments

• Card payments are handled by our payment processor, which is certified to the Payment Card Industry Data Security Standard. We never see or store card numbers.
• Media spend is paid by clients directly to advertising platforms from their own payment methods.

Incidents

We have an incident response procedure with defined escalation. If a personal data breach affects a client's data we tell the client without undue delay and within 48 hours, and report to regulators where the law requires.