How we protect your data

Your marketing numbers show how your business is doing. Here is exactly how we keep them safe.

We can only look, never touch

• Every connection to Meta and Google is read-only. We can't create, edit, pause or delete ads, change budgets, or post anything on your Pages or profiles.
• You choose exactly which ad accounts, Pages, Instagram profiles and websites to share. Nothing else is read.
• Disconnecting deletes the stored numbers and asks Meta or Google to cancel our access straight away.

Your data is encrypted

• In transit: the whole site runs on HTTPS with HSTS, so browsers never connect without encryption.
• At rest: the keys that let us read your Meta and Google data are encrypted with AES-256-GCM before they're stored. The encryption key is kept outside the website folder.
• Passwords are never stored. We keep only an Argon2id hash, the method recommended for passwords today.
• Data is stored on servers in India.

Your account is hard to break into

• Two-step verification with any authenticator app, plus one-time recovery codes. It's required for our own administrators.
• Password guessing is blocked: after a few wrong tries, sign-in is paused for that account and that network.
• Weak passwords are refused, including common ones and ones containing your email.
• New-device alerts: we email you when your account is used on a device we haven't seen.
• Sessions expire after inactivity, and a session cookie copied to another browser stops working. Changing your password signs out every other device.
• You can see recent sign-ins and sign out all other devices from the Security page.

The website itself is locked down

• A strict Content Security Policy lets only our own scripts (and Cashfree's payment form) run, which blocks most cross-site scripting attacks.
• Every form is protected against cross-site request forgery, and pages can't be embedded in other sites (clickjacking).
• All database queries use parameters, which prevents SQL injection.
• Error details are never shown to visitors, and logs never contain passwords or tokens.
• Program files, configuration and logs can't be reached from the web.
• Payments are handled entirely by Cashfree. Card, UPI and bank details never touch our servers, and every payment confirmation is cryptographically verified.

We keep only what we need

• We store daily totals, not personal data about the people who see your ads or visit your site.
• Old numbers are deleted automatically, and so is data for businesses that have been inactive for months.
• Security events are logged for 13 months so we can investigate any suspicious activity, as Indian rules require.
• No advertising or tracking cookies, and no third-party fonts or analytics on our pages.

If something goes wrong

We'll tell affected customers promptly and clearly, and report to the Data Protection Board of India as the law requires. Full details are in our Privacy Policy.

Found a security issue?

Please email security@companysboard.com with the details. We reply quickly, and we won't take action against anyone who reports a problem responsibly and gives us a chance to fix it.