Security
How we protect your data
Encryption at rest
Credentials for connected ad accounts and other sensitive fields are encrypted before they're stored, using a dedicated encryption key kept separate from the database itself.
Encryption in transit
Every connection to the platform, dashboard, and API runs over HTTPS with an automatically issued and renewed TLS certificate.
EU data residency
New accounts default to EU-based hosting. Every transfer of data to a third-party service is declared and logged in a technical register, along with the purpose of the transfer and the recipient's country.
Encrypted backups
Our host, Fly.io, takes a daily snapshot of the database, kept for 30 days in the EU. Every night, a second copy goes to an independent provider, Scaleway, in Paris. We encrypt it before it leaves, so the provider cannot read it. The 14 most recent copies are kept.
Password handling
We never store a password in plain text. Every password is hashed with scrypt, a deliberately memory-hard function, which makes a stolen database expensive to attack rather than merely inconvenient.
Audit logging & rate limiting
Security-relevant actions (sign-in, account creation, support access) are logged. Public-facing endpoints are protected against abuse with request rate limiting.
Tenant isolation
Each customer's data is isolated at the data-access layer itself, not just in the interface, so a display bug can't expose another customer's data.
Questions about security?
Reach us at security@operato-ai.com. For how we handle personal data, see our Privacy Policy.