Security

A plain account of how Advino handles your credentials and your Meta Ads data. Everything below describes what the product actually does today. If something here is unclear or you want more detail, email [email protected] and a human will answer.

1. Meta permissions and what we access

When you connect Meta, Advino requests three permissions: ads_read, ads_management, and business_management. In normal use the product only reads. It pulls campaign performance, creatives, and account health so it can score and monitor them. The management permission is what lets an action you trigger yourself, such as pausing a flagged ad set from the dashboard or through the MCP server, actually run. The one thing Advino can do to your account without you is auto-pause, and it is strictly limited. That is the next section.

2. Maximum blast radius

Auto-pause is the only change Advino can make to your account on its own, and the limit is enforced in code, not by policy. Every live pause runs through an allowlist wrapper that can send exactly one kind of request to Meta: pause an ad set. It physically cannot raise or lower a budget, change targeting or creatives, move money, touch billing, or turn an ad set back on. A test in our suite fails the build if that ever stops being true.

Auto-pause also ships turned down. Every account starts in dry-run: Advino records what it would have paused and calls Meta zero times until you arm that account to live yourself. Anything else that touches your account happens only when you trigger it.

3. Encryption

• All traffic to and from Advino runs over HTTPS (TLS).
• Your Meta access tokens are encrypted at rest with AES-256-GCM before they ever touch the database. They are decrypted only in memory at the moment a sync runs.
• We never log or display raw access tokens.

4. Authentication and sessions

• Passwords are hashed with bcrypt. We never store them in plain text and cannot recover them.
• Your session is carried in an httpOnly cookie that JavaScript on the page cannot read, and is marked Secure in production so it only travels over HTTPS. We do not put session tokens in localStorage.
• You can reset your password at any time from the login screen.

5. Tenant isolation

Advino is multi-tenant. Every database query is scoped to your agency using the identifier inside your signed session token, never an agency identifier sent by the browser. One agency cannot read or write another agency's data, even by tampering with a request.

6. Payments

Billing is handled by Stripe. Card numbers are entered directly with Stripe and never pass through or get stored on Advino's servers. We keep only a Stripe customer reference and your plan status.

7. Disconnecting Meta

When you disconnect Meta from Settings, Advino deactivates your ad accounts and erases the stored access token from our database in the same step. Your historical metrics stay so your past reports still load, but there is no longer a token that could call Meta on your behalf. Reconnecting issues a fresh token.

8. Data retention and deletion

You can ask us to delete your account and all of its data at any time by emailing [email protected]. When you do, we remove your agency and everything tied to it, including Meta accounts and tokens, campaigns, creatives, conversions, alerts, scores, invoices, and team members, from our live systems. Encrypted database backups roll off within 30 days. For details on what we collect and why, see our Privacy Policy.

9. Reporting a vulnerability

If you find a security issue, please tell us before disclosing it publicly. Email [email protected] with the subject line "Security report" and we will get back to you quickly. We are a small team and we take these seriously.