Security

• We connect to Google with OAuth. We never see or store your Google password.
• Google refresh tokens are encrypted with AES-256-GCM before they are stored, and are never sent to your browser, placed in a URL or written to logs.
• You choose which Google Ads and Merchant Center accounts the workspace uses, and can disconnect at any time.
• Changes to Google accounts need approval from a person with the right role, are checked against the latest imported state before they are sent, and are read back from Google afterwards. Every approval and change is kept in an audit log.

• Every workspace's data is separated by row-level security in the database, on every table.
• Roles (owner, administrator, operator, analyst and others) decide who can see, draft and approve what.
• You can sign out of all your other devices from Your account.
• Connected AI tools sign in with OAuth, get only the accounts and permissions you choose, and stop working as soon as you disconnect them. They can never approve a change.

• All traffic uses HTTPS, with HSTS. Pages send a strict content security policy.
• Requests that change data must come from our own pages, and are rate limited.
• The database and servers are run by Supabase and Render in the United States.
• Errors are monitored, and service logs do not contain tokens or the text of Ask UltraROAS conversations.
• Access to production systems is limited to the people who run the service.

If you believe you have found a security problem, email support@ultraroas.ai with the details and steps to reproduce it. We will acknowledge your report, keep you updated, and not take action against good-faith research that follows these rules:

• use only your own accounts and workspaces, and never access or change other people's data;
• do not run automated scans or tests that could disrupt the service;
• give us reasonable time to fix the problem before telling anyone else.

If a security incident affects your data, we will tell workspace owners without undue delay, as set out in the data processing addendum.