Account isolation
- Every project belongs to one account. PostgreSQL row-level security filters every read and write of account data, projects and everything in them, such as observations, connections, reports and alerts.
- The application's database role cannot bypass those policies, and each connection checks your membership again before it returns data.
- The server checks account roles (owner, admin and member) on every request. Hiding a button is never the only protection.
Passwords and credentials
- Passwords are stored only as salted, slow PBKDF2-SHA256 hashes.
- Google connection credentials are encrypted with AES-GCM before they are stored, and only the person who authorized a connection can use it.
- Card details are entered on Stripe's hosted pages; Ads Lighthouse never receives or stores card numbers.
- You never need to share a data provider account with us. Ads Lighthouse runs the monitoring checks itself.
Sessions and forms
- Sign-in cookies are HttpOnly, SameSite=Lax and Secure, expire after 14 days, and are removed when you sign out. Changing a person's site role revokes their sessions.
- Sensitive forms such as invitations and administration check the request origin and a signature tied to your session.
- Sign-up is protected by a server-verified security challenge.
- Other sites cannot embed our pages in a frame. Browser features the product does not use, such as the camera and location, are turned off.
Alerts and outgoing requests
- Webhook and Slack alerts go only to HTTPS addresses that resolve to the public internet; private and local network addresses are refused.
- Each webhook rule signs its requests with its own secret, so your server can verify that a request came from Ads Lighthouse. The secret is stored encrypted and shown only to account owners and administrators.
- Alert messages include only an approved list of observation fields, never internal identifiers or raw collection responses.
- Landing page text captured for analysis is stored privately and read only through authenticated requests.
Hosting and backups
- The application, database and background processing run in a dedicated hosted environment, reached over encrypted connections.
- The database is backed up every day. Each backup is encrypted before it leaves the server and copied to separate backup storage.
- The service providers page lists the categories of providers we use: hosting, network delivery, email, storage and backups, search data collection, AI screening and payments.
Retention and deletion
- Saved monitoring observations and results, including results-page screenshots and landing-page previews, expire after three UTC calendar months. Queued or running work remains until it finishes. Cleanup runs in background batches, so expired records or files can stay for a short time while the queue catches up.
- Current account and project settings and the current status and owner of active cases are preserved. Dated policy findings and case events still follow the three-month window. Billing, payment, authentication and security records have separate retention purposes.
- You can delete a project or your account from the app. Protected backup copies are not deleted at the same time; they expire on their own schedule.
- The administration audit log keeps entries for 30 days.
- Billing and cost records are kept as long as accounting, tax and legal obligations require.
- Reports you open through Google Ads or Search Console connections are shown when you open them and are not saved.
What we do not claim
- Ads Lighthouse does not hold an ISO 27001 certification or a SOC 2 report today.
- We do not promise a guaranteed recovery time or absolute protection against an incident.
- Processing locations, contracting entities and transfer safeguards are listed in the customer agreement and provider schedule. You can request both.
Report a security issue
If you believe you have found a vulnerability, email [email protected] with "Security" in the subject line. Include the page or request involved, the steps to reproduce it and what an attacker could do. We will confirm that we received it and keep you informed while we investigate.
- Test only with an account you own, and never access, change or delete another customer's data.
- Do not run denial-of-service tests, automated scans that degrade the service, or social engineering against our team.
- Give us reasonable time to fix the issue before sharing details publicly.
Email the security reportThere is no paid bug bounty program.