Security

Last updated 16 October 2026

Agencies trust Adbake with their clients’ ad accounts and listings. This page explains how we protect them. Our privacy policy covers what data we collect and why.

Access to ad platforms

• Adbake connects only through each platform’s official API, with the account owner’s authorization. We do not scrape websites.
• We ask only for the permissions our features need. We never request the ones that expose buyers’ personal data, so we never receive it, and no AI model ever sees it.
• Access tokens are encrypted in a secrets vault, readable only by our backend, and never sent to your browser.
• Removing a client deletes its tokens at once. Account owners can also withdraw access from the platform at any time.

Changes to your accounts

• Agents suggest changes and people approve them. Autopilot is off until a workspace turns it on, and then works only inside the guardrails set for each client.
• Bids and budgets come from rules you can read, never from an AI model.
• Every change is logged with who or what made it, and can be undone. A kill switch stops all agents and rules for a client.

Your workspace

• Each workspace’s data is separated inside the database by row-level security on every table, checked by automated tests.
• Roles run from owner to read-only client viewer, and members see only the clients assigned to them.
• Owners and admins must use two-step sign-in with an authenticator app; everyone else can turn it on.

Infrastructure

• Adbake runs on managed cloud providers, in India (Mumbai) during early access. Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256.
• Databases are not reachable from the public internet without credentials, and production access for our staff requires two-step sign-in.
• Security logs are kept for 12 months and watched for unusual access.

Incidents

We keep an incident response plan, reviewed every six months. If an incident affects your data, we tell you without undue delay, and we notify the platforms and authorities we are required to, such as Amazon within 24 hours.

Report a vulnerability

Email founder@nexifii.com. We reply within two business days and will not take legal action against good-faith research that avoids harm to our customers’ data.