Trust
Security
The design decision behind all of this
Adease is a desktop application rather than another browser tab, but the work happens on a backend we run on Google Cloud. Your ad account data is pulled by that backend, held against your organisation only, and cached on your machine so the app stays fast to browse. Every organisation is isolated from every other one, enforced independently in two places — the backend checks membership on every request, and the database rules deny cross-organisation access on their own.
Credentials
Ad account access tokens are held server-side. They are never sent to the desktop app, never written to a log, and never shared between members of an organisation — each person connects their own advertising accounts. Your Adease sign-in session is stored in the operating system's own credential store. Adease asks each advertising platform for the narrowest set of permissions it needs, and revoking access from the platform's own settings cuts Adease off immediately.
Nothing is applied without a person
The agent cannot write to a live ad account on its own. Every change it proposes is queued as a diff and applied only after someone approves it. Each applied action records who approved it and what the platform returned, so there is always an audit trail to work from.
The application itself
- Builds are code-signed by Adease LTD — the macOS build is notarised and the Windows installer is signed — so each operating system can verify them before the first launch.
- Updates are delivered over an authenticated channel and are signed with the same identity.
- Dependencies are monitored for known vulnerabilities and updated as fixes are published.
Our own systems
Our backend runs on Google Cloud and holds your account details, billing records, ad account tokens, and the campaign data, knowledge cards, conversations and reports belonging to your organisation. Staff access is limited to those who need it, protected by multi-factor authentication, and removed when someone leaves. The Privacy Policy sets out exactly what is held, for how long, and which processors are involved.
Before publishing, confirm what you can evidence. If you hold a certification such as SOC 2 or ISO 27001, or you are in an active audit, say exactly which and link the report. If you do not, leave it out — claiming a compliance posture you cannot evidence is a real liability.
Reporting a vulnerability
If you believe you have found a security issue, email support@adease.io with the subject line "Security". Please include enough detail to reproduce it.
We will acknowledge your report, keep you updated while we investigate, and credit you when a fix ships if you would like us to. Please give us a reasonable opportunity to resolve the issue before disclosing it publicly, and avoid accessing or modifying data that is not yours while testing.
Contact
Security questions and due-diligence requests go to support@adease.io.