Security

How we think about it

The most reliable way to protect sensitive data is not to hold it. AdTake is built that way: we do not store passwords, and we do not store card numbers.

What we do hold is your account details and your project work, and this page says plainly how that is protected and where the limits are.

Protecting your data

The measures in place today:

• All traffic between your browser and the service is encrypted with TLS.
• The database is hosted in the European Union and encrypted at rest by the platform it runs on.
• Every project query is scoped to its owner, so one account cannot read another's work.
• Logs record request paths and errors, never your brief content or your email address.

Payments

Payments run through a PCI DSS Level 1 certified payment provider using embedded elements. Your card details go from your browser to that provider directly.

We receive only a token, the card brand, and the last four digits, which is what lets the product show you which card is saved. A full card number never reaches our servers or our database.

Accounts and sign-in

Sign-in is handled by a specialist identity provider. We never see, store or transmit your password, and we could not reveal it if we were asked to.

Multi-factor authentication is available through that provider, and we recommend turning it on. Sessions expire, and signing out ends them.

Who can see what

Access to production systems is limited to the people who need it to operate the service, and is removed when they no longer do.

We do not read your briefs or watch your advertisements out of curiosity. We look at project data only when you ask us to help with something, or when investigating a specific abuse report or fault.

Reporting a vulnerability

If you have found a security problem, we want to hear about it. Write to security@adtake.ai with enough detail to reproduce it.

If you report in good faith, give us a reasonable chance to fix it before telling anyone else, and stay within these lines, we will not pursue legal action against you:

• Do not access, modify or delete data belonging to anyone but yourself.
• Do not degrade the service for other users, including by load or denial-of-service testing.
• Do not use social engineering, phishing, or physical attacks against our people or our providers.
• Stop as soon as you have confirmed the problem, and tell us rather than exploring further.

We acknowledge reports within five working days. We do not run a paid bug bounty, and we would rather say so than imply one exists.

What we have not done yet

AdTake is in private beta, run by a small company, and it would be easy to imply more assurance than is true. So, plainly: we do not hold a SOC 2 report or an ISO 27001 certificate, and we have not commissioned an independent penetration test.

If your organisation needs those before it can buy, tell us at security@adtake.ai. Knowing there is demand is what moves them up the list, and we will not pretend they are already done.

We will update this page when that changes, rather than leaving a claim here to go stale.