Security & trust

• Read and monitor before write: current ad-platform integration work is designed for permissioned reporting, pacing context, and manual review—not campaign optimization or automated spend changes.
• Client-approved budget truth remains separate from platform delivery settings.
• Humans remain responsible for approvals, escalations, and any action taken in an advertising platform.
• Public marketing infrastructure is kept separate from authenticated product and data services.

• Collect and retain only information needed for the disclosed workflow.
• Request the minimum external-platform permissions needed for approved read-only use cases.
• Use OAuth or other provider authorization flows instead of asking customers to share ad-platform passwords.
• Keep access tokens and confidential integration credentials out of client-side code and public logs.
• Use encrypted network connections for public and authenticated web traffic.
• Scope application data by organization and preserve audit context for material governance actions.
• Review higher-risk changes—including authentication, tenant isolation, database policy, credentials, and production configuration—under a stricter preflight and recovery process.

• Clerk manages product authentication and authenticated sessions.
• Advertising-platform credentials remain server-side, with sensitive token material protected using AES-256-GCM application-layer encryption.
• Product data access is scoped by organization in the application's authenticated query paths.
• Material budget-governance actions can produce action-log receipts that preserve organization, actor, action, and timing context.

PacePilot’s intended integration use is budget governance: retrieving authorized account, campaign, spend, and pacing context so an agency can compare delivery with its own client-approved budget model. PacePilot does not need member social content, audience lists, private messages, or customer passwords for that use case.

Access depends on the permissions granted by the customer and the platform. Customers should connect only accounts they are authorized to manage and can revoke provider authorization through the applicable platform controls.

The public website uses third-party hosting, measurement, and form services. Waitlist submissions should contain business contact and workflow information only. Do not submit credentials, access tokens, payment information, or sensitive client records. See the Privacy Policy for current website data practices.

Access to non-public systems and data is intended to be limited to authorized operators and service providers with a business need. Retention should be tied to product operation, security, legal obligations, and customer instructions. Product-level deletion and retention commitments will be documented in the applicable beta or customer agreement before production use.

Suspected incidents are evaluated for containment, investigation, recovery, and any notifications required by applicable law or agreement. Until a dedicated security mailbox or disclosure channel is published, use the waitlist form and begin the workflow-context field with “Security report.” Do not include exploit code, credentials, or sensitive customer data in the form.

This page is a transparent description of current posture and design principles, not a warranty, audit report, certification, data-processing agreement, or complete list of controls. It will be updated as PacePilot completes beta readiness, third-party assessments, and formal customer terms.