Security and data handling
Connecting a Google Ads account means handing over a long-lived credential and a lot of commercial detail. This page says where that data is stored, what stops one workspace reading another's rows, and what the product asks of your Google account. Where a control does not exist yet, it is written down near the bottom rather than left out.
Where the data lives
Everything the product stores sits in a single EU region: the database, the object store holding generated exports, and the workers that produce them. There is no secondary region, no replica outside the EU, and no analytics pipeline shipping rows somewhere else.
One region is the design, not a first step towards several. It costs round-trip time for customers a long way from Europe, and we accept that. There is one exception to the residency statement, and it has a section of its own below rather than a line in a sub-processor list.
One workspace cannot read another
Isolation is enforced by the database, not by application code remembering to filter. Row-level security is on for every tenant-scoped table, and every tenant-scoped query carries a workspace ID as its first parameter. The policies fail closed: when the workspace is not set on the connection, the query returns no rows. It does not return somebody else's.
The API and the background workers connect as a database role created NOBYPASSRLS and NOSUPERUSER, so they cannot step around a policy. Those tables also have row-level security set to FORCE, which applies the policies to the table's owner as well. Migrations run as the owner, on a separate connection string, and nothing that serves a request uses it.
What we ask Google for, and how the token is held
Connecting Google Ads asks for the Google Ads scope, plus your email address and the name on the Google account, so the connection can be labelled where you manage it. Nothing else. Search Console and Google Drive are separate consent screens, shown only when you use those features. The Search Console scope is the read-only one, so nothing here can submit a sitemap or change a property, and an advertiser who never touches the SEO side is never asked for either.
The Google refresh token is envelope-encrypted at rest. Each token gets its own data key, and that key is stored wrapped by a key-encryption key read from a file on the host at start-up, never from the database, so ciphertext lifted from a table or a backup is not usable on its own. The wrapping keys are versioned, which is what lets one be rotated without a flag day. You can revoke the grant from your Google account at any time without telling us first, and disconnecting inside the product revokes it at Google rather than only deleting our copy.
Official Google APIs only
Everything read from Google comes from a published Google API, called under your own OAuth grant and against your own quota. There is no scraping of search results, no headless browser driven at a Google property, and nothing that reads what a signed-in session can see. The product has no way to accept a cookie or a session token, because no code path was ever written to take one.
That is a limit and it shows. A figure that can only be had by reading results pages or by buying clickstream data is not in the product and will not be. Where an API we are permitted to call returns nothing, the screen says the data is missing instead of filling the gap.
AI requests are processed outside the EU
The AI features are processed by Anthropic, outside the EU. That is a real qualification of the residency statement above, which is why it has a heading rather than a footnote. Data the product stores stays in the EU region. The request that reaches the model does not.
What leaves the region is bounded. The model receives keyword terms and their volumes, campaign names, the evidence behind an anomaly, brief outlines, page content you asked it to audit, and your side of an assistant conversation. It is never asked to produce a measured figure: every number is computed before the request is made. The AI features are optional, and a workspace that has never used one still gets its reports, exports, syncs and share links.
What we do not claim yet
The product is new. There is no SOC 2 report, no ISO 27001 certificate, no independent audit and no penetration-test report to send you. Every statement above describes how the code is written, and it is verified by us alone. You are entitled to weigh it accordingly.
We would rather you read that here than reach it in the third round of a procurement questionnaire. When any of it changes, this page changes with it.
Exact deletion windows, table by table, are on the retention page. The figures there are read from the same constants the deletion sweeps run on, so there is nothing to keep in step by hand.