Your accounts and data stay yours
A growth partner sees budgets, results and customer pipelines. That access should be narrow, logged and easy to revoke. The service runs distributed and encrypted across more than 125 countries, and the controls below are built into FOCUSADS.si. We describe what they do, not the vendors and versions behind them, so this page is not a map for attackers.
Three rules we design around
You keep ownership
Advertising accounts, pixels, analytics and CRM stay in your name. We work through user or partner access you grant and can remove at any time. We never ask for passwords.
Least privilege, every time
Staff see only what their role needs. Clients see only their own workspace. Every sensitive action leaves an audit record that cannot be edited afterwards.
Evidence over assertion
Reported numbers carry their source platform, account, date range, currency and collection time, so you can check them against the native dashboard.
Controls in the product
Mandatory two-factor authentication
Every client and staff account must enrol an authenticator app (Google Authenticator or any TOTP app) before the dashboard or the operations console opens.
- QR code and manual key at enrolment, confirmed with a first code.
- Single-use recovery codes, stored only as hashes.
- Sign-in and MFA events are written to the audit log.
Tenant isolation in two layers
Each client workspace is separated in application code and again inside the data layer itself, so a missed check in code still cannot return another client's records.
- Every request runs in a scope that fixes the workspace and the role.
- Server-side authorisation on every read and write; the browser is never trusted for roles.
- Automated tests attempt cross-tenant access to reports, spend, tasks, invoices and plans.
Delegated platform access
We request access through Google Ads manager links, Meta Business partner access, LinkedIn account roles and equivalent platform features. You can see and revoke each grant from your platform settings.
- No shared logins, no password collection.
- Access status is shown per account in your dashboard.
Append-only audit log
Sign-ins, MFA changes, role and access changes, billing events, report publication and data exports are recorded. The database rejects edits or deletions of audit records.
- IP addresses are pseudonymised before storage.
- Secrets and tokens are never written to logs.
Encrypted transport and strict headers
All traffic uses TLS with HSTS. The application sends a content security policy, frame protection, a strict referrer policy and a restrictive permissions policy.
- Session cookies are HttpOnly, Secure and SameSite=Lax.
- Sign-in and form endpoints are rate limited.
Card payments kept off our systems
Checkout, invoices and the billing portal run with a PCI DSS-certified payment provider. Card numbers never reach our servers. Payment state changes only on signed, verified events, each processed once.
- Repeated events have no effect.
- Media spend is not charged through FOCUSADS unless your order form says so.
Signed data ingestion
Performance evidence enters the platform only through cryptographically signed, time-limited, single-use requests, so captured data cannot be forged or replayed.
- Late or repeated requests are rejected.
- Corrections are stored as revisions; published report versions cannot be altered.
Distributed and encrypted in 125+ countries
The service is delivered from a distributed network spanning more than 125 countries, encrypted in transit and at rest. Production and test environments are fully separate, and test environments are never indexed.
- Secrets are held in managed secret storage, separate per environment, never in source code.
- Dependency, secret and code scanning run on every change.
Data handling at a glance
- Data controller
- THEFOCUS LTD for website enquiries and accounts; you, the client, for data in your workspace.
- Applicable law
- UK GDPR, the Data Protection Act 2018 and PECR.
- Special category data
- Not accepted. Health or other sensitive data must not be uploaded or used for targeting.
- Breach notification
- Clients notified without undue delay, within 48 hours of us becoming aware.
- Retention
- Audit logs 24 months; client records for the contract plus 6 years; unconverted enquiries 24 months.
- Subprocessors
- Listed by category on the Subprocessors page: infrastructure and hosting, payments, email, and analytics (only with consent). The named list is available to clients in the dashboard and on request.
Found a vulnerability?
Report it through the contact form and choose "Security report". Include the affected URL, steps to reproduce and impact. Please do not access data that is not yours or disrupt the service. We acknowledge reports within two UK business days and keep you updated until the fix ships.
Send a security reportWhat we do not claim
- We do not hold ISO 27001 or SOC 2 certification today. If that changes, this page will say so with the certificate details.
- We are not an official partner of the advertising platforms named on this site unless a page states the specific programme.
- No security control removes all risk. We describe what is in place and how we respond when something goes wrong.
Do you need our advertising-account passwords? No. We request access through each platform's own permission system, for example a Google Ads manager-account link or Meta Business partner access. You approve it in the platform and can remove it at any time.
Can another client see our data? No. Workspaces are isolated in application code and again in the data layer, and we test cross-tenant access attempts automatically.
Is two-factor authentication optional? No. Every client and staff account must set up an authenticator app before accessing the dashboard or the operations console.
Where is our data hosted? On a distributed, encrypted network spanning more than 125 countries. Transfers outside the UK rely on recognised safeguards described in the privacy notice and on the Subprocessors page.
Need a security review before you sign?
Enterprise teams can request our security questionnaire answers and the data processing addendum during qualification.