Account isolation
- Every project belongs to one account. PostgreSQL row-level security filters account data, projects and everything under them, such as observations, connections, reports and alerts, for reads and writes.
- The application's database role cannot bypass those policies, and each connection checks your membership again before it returns data.
- Account roles (owner, admin and member) are checked by the server on every request. Hiding a button is never the only protection.
Passwords and credentials
- Passwords are stored only as salted, slow PBKDF2-SHA256 hashes.
- Google connection credentials are encrypted with AES-GCM before they are stored, and only the person who authorized a connection can use it.
- Card details are entered on Stripe's hosted pages; Ads Lighthouse never receives or stores card numbers.
- You never share a data provider account with us: Ads Lighthouse runs the monitoring checks itself.
Sessions and forms
- Sign-in cookies are HttpOnly, SameSite=Lax and Secure, expire after 14 days, and are removed when you sign out. Changing a person's site role revokes their sessions.
- Sensitive forms such as invitations and administration check the request origin and a signature tied to your session.
- Sign-up is protected by a server-verified security challenge.
- Pages cannot be framed by other sites, and the browser features the product does not use, such as the camera and location, are switched off.
Alerts and outgoing requests
- Webhook and Slack alerts go only to HTTPS addresses that resolve to the public internet; private and local network addresses are refused.
- Each webhook rule signs its requests with its own secret, stored encrypted and shown only to account owners and administrators, so your server can verify that a request came from Ads Lighthouse.
- Alert messages contain an allowlist of observation fields, never internal identifiers or raw collection responses.
- Landing page text captured for analysis is stored privately and read only through authenticated requests.
Hosting and backups
- The application, database and background processing run in a dedicated hosted environment, reached over encrypted connections.
- The database is backed up every day. Each backup is encrypted before it leaves the server and copied to separate backup storage.
- The service provider categories involved (hosting, network delivery, email, storage and backups, search data collection, AI screening and payments) are listed on the service providers page.
Retention and deletion
- Observations are kept while your account uses them, so you can review your monitoring history.
- You can delete a project or your account from the app. Protected backup copies are not removed at the same moment and expire on their own schedule.
- The administration audit log keeps entries for 30 days.
- Billing and cost records are kept as long as accounting, tax and legal obligations require.
- Reports opened through Google Ads or Search Console connections are shown for that request and not saved.
What we do not claim
- Ads Lighthouse does not hold an ISO 27001 certification or a SOC 2 report today.
- We do not promise a guaranteed recovery time or absolute protection against an incident.
- Processing locations, contracting entities and transfer safeguards are set out in the customer agreement and provider schedule, which you can request.
Report a security issue
If you believe you have found a vulnerability, email [email protected] with "Security" in the subject line. Include the page or request involved, the steps to reproduce it and what an attacker could do. We will confirm that we received it and keep you informed while we investigate.
- Test only with an account you own, and never access, change or delete another customer's data.
- Do not run denial-of-service tests, automated scans that degrade the service, or social engineering against our team.
- Give us reasonable time to fix the issue before sharing details publicly.
Email the security reportThere is no paid bug bounty program.