ADSflow
Log in Get started

Security

How ADSflow protects your data

ADSflow holds access to your ad accounts. These are the controls we use to keep that access safe.

Last updated

Meta access tokens

  • ADSflow connects to Meta only through Facebook Login for Business. We never ask for, receive or store Facebook passwords, cookies or browser sessions.
  • Access tokens are encrypted at application level with AES-256-GCM before they are written to the database. The encryption key is kept in the server environment, separate from the database and its backups.
  • Tokens are used only on our servers and never sent to browsers. Every Graph API call carries an appsecret_proof signature, and the app secret never leaves the server.
  • When you disconnect, ADSflow revokes its permissions with Meta and deletes the token.

Encryption in transit

All traffic to adsflow.tech and to Meta's APIs uses HTTPS with TLS 1.2 or higher. Session cookies are HttpOnly, Secure and SameSite=Lax.

Workspace isolation

Every record in ADSflow belongs to a workspace, and every query is scoped to the workspace of the signed-in user. Data of different advertisers is never mixed or shared across workspaces. Inside a workspace, owner, admin and member roles control who can connect accounts, change campaigns and invite people.

Logging and audit

  • Every call ADSflow makes to the Meta APIs is logged with time, endpoint, result and rate-limit headers - never with the token.
  • Every action taken on your behalf - launches, status and budget changes, rule runs, comment moderation, connections and deletions - is recorded in the workspace audit log.

Access by our team

Access to production systems is limited to the people who operate ADSflow, granted on a need-to-know basis and logged. We look at workspace data only to answer your support request or to investigate a security issue.

Backups and deletion

Backups are encrypted and rotated; copies older than 30 days are destroyed. Deletion requests remove data from the live database and, as backups expire, from backups - within 30 days. See Data Deletion.

Incident response

If we detect a security incident that affects your data, we contain it and begin remediation immediately, notify affected workspace owners without undue delay, and notify Meta through its incident reporting channel as soon as practicable when Platform Data is involved. We also notify data protection authorities where the law requires it.

Report a vulnerability

If you believe you have found a security vulnerability in ADSflow, please email security@adsflow.tech with steps to reproduce. We acknowledge reports within 3 business days and keep you updated until the issue is fixed. Please do not access data that is not yours, degrade the service or publish details before we have fixed the issue. We will not take legal action against good-faith research that follows these rules.

Machine-readable contact: /.well-known/security.txt.