Security and data protection

Access only with authorization

Jeff reaches a customer's Amazon Ads account only after an authorized user of that account grants access through Amazon's Login with Amazon. We request the campaign management permission and nothing broader. Customers can revoke access at any time from their Amazon account.

Changes need a human

• By default, every change to bids, keywords, negatives or budgets is shown to the customer with its reason and applied only after an approver on that account clicks Approve.
• Customers may enable autopilot per advertising profile. Autopilot is bounded by limits enforced in code, not by the AI model: a maximum bid change, a bid floor and ceiling, a daily change cap and an allowlist of action types. Anything outside the limits goes back to a person.
• Every change is logged with the value it replaced, the approver and the time, and can be reverted.

Isolation between customers

• Each customer works in its own private Slack channel. The customer is identified from the channel a request arrives in, never from text an AI model produces.
• Every database row belongs to one customer account, and Postgres row-level security blocks reads and writes across accounts.
• The AI model cannot choose which account it works on: its tools are bound to the requesting customer's account before it runs.

Encryption and credentials

• OAuth credentials are encrypted at rest with AES-256-GCM, bound to their account, and never sent to an AI model.
• All network traffic is encrypted with TLS. Databases are encrypted at rest by our hosting provider.
• Application secrets are held in our host's secret store, not in source code.

People and access

• Production access is limited to named personnel who need it, with multi-factor authentication on every administrative account.
• We look at a customer's data only to provide support they asked for, or to keep the Service secure.

AI processing

Requests go to our AI model provider under API terms that prohibit training on customer data, with optional request storage turned off. Customer data is never used to train any model, ours or anyone's.

Retention and deletion

We keep advertising data only as long as needed to provide the Service. When a customer disconnects or asks, we stop access immediately and delete their Amazon Advertising data, conversation history and credentials within 30 days.

Incidents

If we detect a security incident affecting customer data, we contain it, notify affected customers without undue delay, and notify Amazon as its policies require. Report a security issue to [email protected].

Service providers