ISO/IEC 27001:2022
Information security management system.
Status to confirmDetails
- Scope
- Not supplied
- Issued
- Not supplied
- Expires
- Not supplied
- Evidence
- Certificate pending
Trust Center
How AdFence accesses advertising accounts, protects data and evidences compliance.
Compliance
Statuses reflect published or supplied evidence only.
CSA STAR Level 1
Self-assessment (CAIQ) on the CSA registry.
Registry link neededDetails
- Registry
- Link pending
- CAIQ
- Not supplied
- Submitted
- Not supplied
Penetration Test
Independent third-party application testing.
Report neededDetails
- Firm
- Not supplied
- Test date
- Not supplied
- Scope
- Not supplied
- Report
- Request access
GDPR
Regulation, not a certification. Reflects the published policy.
Policy publishedDetails
- Policy
- adfence.io/privacy-policy
- DPA
- Awaiting publication
- Reviewed
- Not supplied
Future: SOC 2 Type II evidence has not been supplied.
Security at a glance
Published practice means described on adfence.io. Others need confirmation.
- Encryption at rest & in transitPublished practice
- OAuth-based connectionsPublished practice
- Read-only access by defaultPublished practice
- Role-based access controlsPublished practice
- Security loggingScope to confirm
- Cloud infrastructureDetails to confirm
Reliability
Status pageUptime 30d
—
Feed not connected
Uptime 90d
—
Feed not connected
Incidents 90d
—
Feed not connected
Figures populate once the status feed is connected.
Security contact
- Emailsecurity@adfence.io
- Report a vulnerabilityEmail with subject
- security.txtPending
- Disclosure policyPending
Routing to confirm. Do not include customer data in reports.
Evidence requests
Restricted document access requires approval. Requests go by email to hello@adfence.io; availability is confirmed during review. Public documents open directly.
Account access
Source: adfence.io/security
- 1Ad platformsMeta, Google, TikTok
- 2OAuthPlatform issues a token. No password shared.
- 3AdFenceReads campaign and spend data in scope.
- 4MonitoringWatches connected accounts for your conditions.
- 5AlertsNotifies your team. Optional Kill Switch.
- Read-only by default. Standard connections request read scopes only.
- No ad-account passwords stored. Access uses platform-issued OAuth tokens.
- Kill Switch is opt-in. Write permission is requested only if enabled, limited to pausing campaigns you select.
- Revoke anytime. Disconnect in AdFence or in the platform's connected apps. The token stops working.
Scope and token notes
Scopes, permission names and token handling are defined by each platform and differ across Meta, Google and TikTok. Alert delivery depends on platform data availability and your configuration. Detailed scope lists and token lifecycle are provided during security review.
Security controls
Expand a category for published practice and evidence still required.
Access ManagementPublished practices
Published
- Role-based access controls in the AdFence workspace.
- Ad accounts connected via platform OAuth, read-only by default.
- Connections revocable by the customer at any time.
To confirm in review
- MFA enforcement for staff and availability to customers.
- Frequency and approval of internal access reviews.
- Offboarding for staff with production access.
Source: adfence.io/security
Application SecurityEvidence pending
To confirm in review
- Secure development lifecycle with code review before release.
- Dependency vulnerability scanning and triage.
- Penetration testing cadence and scope.
Evidence needed
- Secure development policy or summary.
- Latest penetration test report or attestation letter.
- Vulnerability management procedure and remediation targets.
Data SecurityPublished practices
Published
- Data encrypted in transit (TLS) and at rest.
- AdFence account passwords stored hashed.
- Advertising account passwords are not stored.
To confirm in review
- Data categories, retention periods and deletion on termination.
- OAuth token protection at rest and who can access tokens.
- Key management for encryption at rest.
Sources: adfence.io/security · adfence.io/privacy-policy
Infrastructure SecurityEvidence pending
To confirm in review
- Cloud provider and regions hosting production.
- Network segmentation and restriction of production access.
- Separation of production from development and test.
Evidence needed
- Architecture diagram (restricted).
- Hosting provider and region in the subprocessor register.
- Configuration hardening or baseline summary.
Monitoring & LoggingEvidence pending
To confirm in review
- Events logged (authentication, admin actions, data access).
- Log retention and access.
- Alerting on suspicious activity and who responds.
Evidence needed
- Logging and monitoring policy or summary.
- Log retention periods.
The privacy policy refers to regular security reviews and monitoring but does not define log controls.
Incident ResponseEvidence pending
To confirm in review
- Documented incident response plan with defined roles.
- Customer notification approach and timeline for a confirmed breach.
- Incident response exercises.
Evidence needed
- Incident response plan summary.
- Breach notification commitments (typically in the DPA).
Business ContinuityEvidence pending
To confirm in review
- Backup frequency and restore testing.
- Recovery time and recovery point objectives.
- Behaviour when an ad platform API is unavailable.
Evidence needed
- Business continuity / disaster recovery summary (restricted).
- Backup and restore test records.
Vendor SecurityEvidence pending
To confirm in review
- Subprocessors handling customer data, and where.
- Vendor assessment before onboarding and over time.
- Customer notification of subprocessor changes.
Evidence needed
- Approved subprocessor register with regions and review date.
- Vendor risk assessment procedure.
See Subprocessors for the current register.
Public
Published pages open on adfence.io.
- Security OverviewPublic summary of security practices.PublishedOpen
- Privacy PolicyPersonal data processing and rights.PublishedOpen
- GDPR InformationRights and choices section of the privacy policy.PublishedOpen
- Subprocessor ListThird parties that process customer data.IncompleteView
- Data Processing AgreementGDPR Article 28 terms for customers.Awaiting publicationNot yet available
- Responsible Disclosure PolicyHow to report vulnerabilities.Awaiting publicationNot yet available
- CSA STAR / CAIQSelf-assessment questionnaire.Awaiting registryNot yet available
- ISO/IEC 27001 CertificateCertificate with scope and validity.When availableNot yet available
Restricted
Availability and scope are confirmed during review.
- Penetration Test ReportFull findings and remediation status.RestrictedRequest
- Architecture DiagramSystem components, data flows and hosting.RestrictedRequest
- Security QuestionnaireCompleted standard questionnaire responses.RestrictedRequest
- Business Continuity / Disaster RecoveryContinuity plan summary and recovery objectives.RestrictedRequest
- SOC 2 ReportSOC 2 Type II evidence has not been supplied.FutureNot requestable
Subprocessors
Register incomplete · awaiting approval- StripePayment processingLocation to confirm
- Hosting provider · pendingApplication hosting and storagePending register
- Email delivery provider · pendingTransactional email and alertsPending register
- Monitoring provider · pendingService monitoring and error trackingPending register
Stripe is the only provider named in the published privacy policy. Pending rows are categories, not confirmed vendors.
Planned