Skip to content

Trust center

Security you can audit, not just trust.

What security, legal and IT teams ask in a vendor review, from data handling and AI limits to access and sub-processors, in one place.

Talk to us about securitySee sub-processors
Policy windows45-day viewHow long AdsOS policies run, in days: suggestions read the last 14 days of results, an applied change can be undone for 7 days, results are measured on day 7, and audit entries are kept for 365 days.

  • Suggestions read back14 days

  • Undo an applied change7 days

  • Results measuredDay 7

  • Audit log kept365 days

One bar = one dayAI governance ↓

01In place today

AdsOS holds no third-party certification yet. These are the controls built into the product today.

  • AES-256-GCMSecrets and OAuth tokensEncrypted
  • Passkeys + 2FATwo-factor required for staffAvailable
  • Audit logEvery decision, 365 daysAlways on
  • CertificationsSOC 2, ISO 27001Not yet

02Data protection

How secrets, workspace data and personal data are stored and deleted.

Secrets & tokens
Encrypted with AES-256-GCM, with key rotation; never returned in API responses
Workspace isolation
Every workspace-owned record is scoped to its workspace on each request
Audit retention
Audit entries are kept for 365 days, then deleted automatically
Account deletion
Delete your account in settings to erase the personal data only you can access
Meta data deletion
Meta’s data-deletion callback is supported for people who remove AdsOS

03AI governance

Rules enforced by the platform, not by a policy PDF.

  • A person approves every changeNothing reaches Meta, Google or TikTok until someone approves it.Always on
  • Read-only AI accessFriday AI reads Meta through a fixed read-only list, scoped to your workspace.Always on
  • AI never publishesApproved changes go out through the publish pipeline, never from the AI itself.Always on
  • Second approverOn Business and Agency plans, require two approvals before a change goes out.Optional

04Access control

Who can sign in and what each person can do. SAML and SCIM single sign-on are not offered today.

  • Sign-in

    Passkeys, two-factor, and Google or Facebook sign-in. Staff must use two-factor.

  • Roles

    Owner, editor and viewer in every workspace. Platform staff roles are separate.

  • Audit trail

    Every AI suggestion, human decision and integration or billing change, logged.

05Sub-processors

Third parties that process data when you use AdsOS, and what for.

VendorPurposeCategoryWhen
AnthropicClaude models for Friday AI chat, copy, plans and reviewsAI modelText tasks
OpenAIgpt-image for banner and image generationAI modelImage tasks
DeepSeekText generation, routed by task and planAI modelText tasks
DOKUPlan, add-on and AdPoin paymentsPaymentsBilling
ResendAccount and notification emailEmailEmail sends
MetaGraph API and Ads MCP for your Meta ad accountsAd platformWhen connected
GoogleGoogle Ads API for your Google Ads accountsAd platformWhen connected
TikTokTikTok API for your TikTok ad accountsAd platformWhen connected

06Policies & requests

The documents and requests a vendor review usually asks for.

  • Privacy policyWeb page · how AdsOS handles personal dataPublicRead
  • Terms of serviceWeb pagePublicRead
  • Account deletionIn account settings · erases your personal dataIn appLog in
  • Meta data deletionCallback for people who remove AdsOS on FacebookSupportedAsk us
  • Security questionnaireSend yours; we’ll walk through it on a callOn requestTalk to us

07 · Report a vulnerability

Found something? Tell us first.

Send the details and steps to reproduce through our contact form. Please don’t access other people’s data or disrupt the service while testing.

Contact the team