Security and access

Updated November 12, 2026

The security model in one paragraph

AdsGuru holds a revocable, scoped token for each connected ad account, issued by Google or Meta when you approve the OAuth grant. The scope is ads management only; the token can read performance and apply campaign changes, and can do nothing else: no billing, no user management, no other products on your Google or Meta account. You hold two independent kill switches, one on each platform, that work without asking AdsGuru anything.

On top of the scoped access sits the behavioral guarantee: approval mode is the default, so the token is exercised for writes only when you approve a proposal or when a routine you explicitly promoted to autopilot acts inside its caps. Every write is logged, and every write is independently visible in the platform's own change history. The security page states the formal commitments; this page is the practical walkthrough.

What OAuth means in practice

OAuth is the industry-standard delegation protocol: you sign in on the platform's own page (accounts.google.com or facebook.com), the platform verifies you, shows you exactly what is being requested, and issues the application a token limited to that request. Your password travels between you and the platform only; AdsGuru never sees, stores or could leak it.

Three properties matter day to day. Tokens are scoped: a token for ads management cannot read your Gmail, your Drive, your Page messages or your payment methods, no matter what the application wanted. Tokens are revocable: removing the grant kills access immediately, platform-side. And grants are visible: both platforms list every application with access to your account, so an audit of who-can-touch-what is a settings page, not an investigation.

The consent screens are worth reading when you connect Google Ads or connect Meta: verify the requested scope matches what this page claims. Trust that is checkable beats trust that is asserted.

If you suspect a compromise

If anything in your ad accounts looks like unauthorized activity, campaigns you did not create, spend in countries you do not serve, a payment method you do not recognize, act in this order:

1. Pause the affected campaigns in the platform directly; stopping spend beats diagnosing first.
2. Change the password and check recovery settings on the Google or Facebook login involved, and confirm two-factor authentication is on.
3. Review the platform's user and partner access lists; remove anything you cannot name.
4. Review third-party app grants on the platform and revoke anything unfamiliar (AdsGuru included, if you want a clean slate; reconnecting later takes minutes).
5. Read the platform change history to establish what was done and when; this is also what platform support will ask for.
6. Contact the platform's support about fraudulent spend; both networks have processes for compromised-account charges.

AdsGuru's role in this scenario is mostly evidence: the change log and the nightly audit's unrecognized-change flags help establish the timeline. Compromises almost always enter through human logins, which is why the two-factor item on this page is the one that matters most.

Exactly what access AdsGuru has

The deliberate absence: there is no superuser mode, no support backdoor into your campaigns, and nobody at AdsGuru manually operating your account. It is software exercising a scoped token against proposals you approved.

The change log

Every applied change, whether you approved it or an autopilot routine ran it inside caps, is logged with the timestamp, the routine and proposal that produced it, the reason, the before and after values, and who approved it. The log answers 'what changed, when, and why' for any point in the account's history under management.

Before-and-after values are what make changes reversible in practice: a budget trimmed from $80 to $64 can be restored to exactly $80, a paused ad re-enabled, a negative list entry removed. Reversal is itself a logged change, so the history stays complete rather than rewriting itself.

The log is also exportable evidence for teams and clients: agencies on the Agency plan can pull change history through the read-only API for client reporting.

Verify independently on the platforms

You never have to take the log's word for anything, because both platforms keep their own records of API changes. In Google Ads, Change history (under Campaigns) lists every change with its source, so AdsGuru-applied changes appear there attributed to the connection. On Meta, the account's activity history serves the same role.

This independent trail is the honest answer to 'how do I know it only did what I approved': cross-check any week of the AdsGuru log against the platform's own history. The first week of a trial is a good time to do it once, the same way you spot-check a proposal's evidence against the platform before trusting the stream.

How to revoke access

Three ways, any of which works alone:

1. Google-side: myaccount.google.com, Security, Third-party apps with account access, remove AdsGuru. Kills the Google token immediately.
2. Meta-side: business.facebook.com, Business settings, Integrations (or profile Settings, Apps and websites), remove AdsGuru. Kills the Meta token immediately.
3. AdsGuru-side: Settings, Connections, Disconnect per connection, or cancel the subscription and connections close at period end.

Revocation stops reads and writes at once; campaigns keep running exactly as they are. Platform-side revocation works even if you cannot reach AdsGuru at all, which is the point of having it. Synced data is deleted within 30 days of disconnection, per the data policy.

Data protection basics

Data in transit is encrypted (TLS), and data at rest is encrypted. What is stored is the minimum the product needs: campaign structure, performance metrics, change history, plus your AdsGuru account and billing details; what is never stored is platform passwords, your customers' personal data, or your payment methods for ad spend. The data and privacy page itemizes it, and the privacy policy is the formal document.

Access tokens are stored encrypted and used server-side only. Requests to hello@adsguru.co handle data questions, exports and deletion.

Operationally, access inside AdsGuru follows the same least-privilege thinking the product demands of the platforms: production data access is limited and logged, and tokens are usable only by the systems that run the loop.

Secure the rest of your setup

AdsGuru's scope is one slice of ad account security; the rest is worth doing regardless of any tool:

• Two-factor authentication on every Google and Facebook login with access to the ad accounts; account takeovers via weak logins dwarf API risks in practice.
• Least privilege for humans too: contractors get standard access, not admin; departed staff get removed the week they leave. Both platforms' access pages make the audit a ten-minute job.
• Separate Business Manager admin from daily use on Meta: admin rights on the profile that browses all day is unnecessary exposure.
• Review third-party grants quarterly: both platforms list connected apps; remove anything you no longer use, including, if it comes to it, AdsGuru.
• Watch change history for strangers: unexplained changes in platform change history deserve investigation, whoever or whatever made them; the nightly audit flags unrecognized settings changes.

Common questions

Related