Security is not a marketing surface. This page is where we write down what we actually do so that you — and your compliance team, and the ad platforms we work with — can check our work.
All traffic — public, internal, and webhook — is served over HTTPS with HSTS preloaded.
Certificates are issued and renewed automatically by the platform. No manual touchpoints.
Account sign-in is delegated to Google. No passwords are stored on our servers.
Google Ads, Meta Ads, and TikTok Ads integrations use per-user OAuth with minimum required scopes. Tokens are rotatable from each platform at any time.
Service-to-service calls between our web, API, and worker use short-lived signed tokens. No long-lived API keys in flight.
Postgres volumes and object storage are encrypted at rest with platform-managed keys.
OAuth client secrets, platform API keys, and encryption keys live in Google Cloud Secret Manager with tight IAM bindings.
Production, staging, and development run on separate projects with separate credentials and separate ad accounts.
Engineers get the minimum access required to do their job. No standing production admin rights.
Every mutation on a campaign, asset, lead, or account is recorded with actor, timestamp, and diff.
Roles, service accounts, and third-party integrations are reviewed every quarter and trimmed on the same schedule.
Postgres is backed up continuously with point-in-time recovery. Restore drills are run on a cadence, not left as theory.
Supply-chain vulnerabilities are tracked via automated scanners. Critical issues are patched within 72 hours.
A written runbook describes the first 60 minutes of any security incident. We publish post-mortems for anything user-visible.
Found something broken? Tell us first.
If you discover a vulnerability, please email security@signalbench.io with a description, reproduction steps, and — if you have one — a proof of concept. We commit to a first acknowledgement within 24 hours and a remediation plan within seven days.
We do not run a cash bounty program yet but we gratefully credit researchers in our security acknowledgements with their permission.