Security at AdsGuru

How access works

AdsGuru gets access to your ad accounts through OAuth over the official Google Ads and Meta APIs, and through nothing else. We never ask for your Google or Meta passwords, never store platform credentials, and never use browser automation or scraping against your accounts. When you connect an account, the platform itself shows you the consent screen listing what AdsGuru may do, and the platform, not AdsGuru, holds the key to that grant.

The grant is scoped to ads management: reading campaign structure and performance, and making the campaign-level changes you approve. AdsGuru does not request scopes for your email, your files, your pages' inboxes, or anything outside the ad accounts. If a future feature ever needed an additional scope, it would be a new, separate consent you could decline.

You can revoke access at any time

Revocation works from your side, independently of us: remove AdsGuru from your Google account's third-party access settings or your Meta Business settings, and our access ends at that moment, whatever state your AdsGuru subscription is in. You do not need to contact us, and nothing in the product depends on asking us first.

Disconnecting inside AdsGuru does the same thing through the API. Either way, once access ends we can no longer read or change anything, and ad account data we hold is deleted within 30 days as described in the privacy policy.

The approval gate as a security control

The approval gate is a security property, not only a workflow: in the default mode, software cannot alter your account without a human decision, which bounds the blast radius of any bug, bad proposal or compromised session. Autopilot, when you enable it, is scoped per routine and limited by spend caps, so even delegated authority has hard edges you set.

Every applied change, approved or autopilot, is logged with the timestamp, the reason and the before-and-after values, and is visible in your account history on the platform itself as well as in AdsGuru. The log is your audit trail: if anything in the account ever looks wrong, the log answers what changed, when and why, and changes can be reversed from the recorded previous values. How the routines decide is documented in how AdsGuru works.

How your data is handled

Ad performance data is used to manage your account and for nothing else. We do not sell it, we do not share it with advertisers or data brokers, and we do not use one customer's data to benefit another customer's account.

• Encryption in transit. All traffic between your browser and AdsGuru, and between AdsGuru and the Google and Meta APIs, runs over TLS.
• Encryption at rest. Stored data, including ad account data and OAuth tokens, is encrypted at rest.
• Least data. We store what the product needs to audit, propose and report: campaign structure, performance metrics, change history and your settings. We do not pull your customer lists or audience data into AdsGuru.
• Retention. Ad account data is kept while the connection is active and deleted within 30 days of disconnecting; details in the privacy policy.
• Subprocessors. Cloud hosting and payment processing providers under data processing agreements, listed in the privacy policy. No advertising or analytics brokers.

Internal practices

Internally we run the practices a small SaaS actually can run well, and we describe them plainly instead of dressing them up.

• Least-privilege access inside the team: production access is limited to the people who operate the service, and customer ad data is accessed for support and debugging only.
• No password handling. Platform access is OAuth-only, so there are no customer platform passwords anywhere in our systems to leak.
• Separation of environments. Development and testing run against test accounts, never against customer ad accounts.
• Billing isolation. Payments are handled by our payment processor; full card numbers never touch AdsGuru's servers.
• Dependency and patch hygiene on the infrastructure and libraries the service runs on.

What we do not claim

We do not hold SOC 2, ISO 27001 or similar certifications, and this page will not pretend otherwise. AdsGuru launched in 2026 and is a small company; formal audits may come as the company grows, and when one is completed it will be named here with its scope. Until then, we would rather describe real practices accurately than borrow the vocabulary of certifications we have not earned. If your procurement process requires attestations we do not have, we are happy to answer a security questionnaire honestly: write to hello@adsguru.co.

Your part of the security model

Two practices on your side close most of the remaining risk. Protect the email account and password you use to sign in to AdsGuru, since your AdsGuru login is what guards your approval queue. And set autopilot limits that reflect real tolerances: spend caps are enforced, so a conservative cap is a genuine bound on what automation can do while you are not looking. Guidance is in the security help article and data and privacy help.

The data flow, end to end

The whole data path fits in one paragraph, which is itself a security property. Your browser talks to AdsGuru over TLS. AdsGuru talks to the Google Ads and Meta APIs over TLS, authenticated by the OAuth grant you approved, reading campaign data and writing only the changes you approved or placed under capped autopilot. Ad data and tokens rest encrypted in our infrastructure at our hosting subprocessor. Billing flows through the payment processor, which alone holds card numbers. Nothing in the path involves your platform passwords, browser extensions, scrapers, or any third party beyond the subprocessors named in the privacy policy.

Reporting a vulnerability

If you find a vulnerability in AdsGuru, report it to hello@adsguru.co and we will respond quickly, prioritize a fix, and credit you if you want credit. Please include steps to reproduce, do not access other customers' data while demonstrating the issue, and give us reasonable time to fix it before public disclosure. We do not pursue good-faith researchers.

Common questions