Least access
Access to systems and data is limited to the people who need it for their work, and removed when they no longer do.
Security
Layers aroundwhat we hold.
Security is a set of habits applied to every system and every supplier. This page states the principles we work to, and it does not claim any certification.
Principles
Seven principleswe hold ourselves to.
These are commitments about how the platform is run. They describe practice, and the detail of controls is shared with customers under the agreement.
Encryption
Data is encrypted in transit between systems and at rest in storage, as a matter of practice.
Separation
Each advertiser's data is kept apart from every other advertiser's, so one customer's audiences are never visible to another.
Logging of access
Access to systems that hold customer data is recorded, so that questions about who did what can be answered afterwards.
Secure development
Changes to the platform are reviewed by a second person before release, and security is considered while a change is designed.
Supplier assessment
Infrastructure and service providers are assessed before we use them and bound by written terms carrying the same duties.
Incident response
We keep a plan for security incidents. When customer data is affected, we notify the customer without undue delay and give it what it needs to meet its own duties.
What we do not hold
Some data wenever need.
Not needed
Retargeting runs without it.
- Names of the people being retargeted
- Email addresses and phone numbers
- Payment card data from customers' users
What it runs on
Identifiers and events.
- Advertising identifiers, where the person allowed them
- App events such as sessions and purchases
- Consent signals passed with each request
Payment card data is not processed on this website. Contact forms collect only what a person types into them. See Data handling for the full picture.
Responsible disclosure
Tell us what you found.
If you believe you have found a weakness in our website or platform, we want to hear about it first. Report it through our contact page with the word Security in the message.
What to include
- Where the issue is, with the address or system affected
- How to reproduce it, step by step
- What you think an attacker could do with it
- How to reach you for follow-up questions
Our commitments
What happens afteryou report.
Acknowledge
We confirm that we received your report and tell you who is looking at it.
Investigate
We reproduce the issue, assess its impact and keep you informed of progress.
Fix
We correct the problem and check that the fix holds.
Credit
With your permission, we name you as the finder. If you prefer to stay anonymous, we respect that.
Safe harbour
If you act in good faith, we will not pursue action against you for research that follows these rules. Look only at what you need to show the problem. Do not read, change or keep other people's data. Do not disrupt the service. Give us reasonable time to fix the issue before telling anyone else.
Out of scope
- Social engineering of our staff or suppliers
- Physical attacks on any premises or devices
- Denial of service and volume-based testing
- Spam or content-injection reports with no security impact
- Third-party systems that we do not operate
No third-party certification today. We hold no third-party security certification at present. If that changes, we will publish it here, with the scope it covers, and not before.
Questions
Security, answered.
Can we run a security review of your platform?
Send a questionnaire through the contact page. We answer what we can in writing, and say plainly where an answer is not yet available.
Do you notify customers of a breach?
Yes. When customer data is affected we notify the customer without undue delay, with the information it needs for its own obligations.
Is our data mixed with other advertisers' data?
No. Each advertiser's data is kept separate, and audiences built for one customer are not used for another.
Do you pay for vulnerability reports?
We do not offer a paid bounty programme. We acknowledge good-faith reports and credit finders with permission.
Do you process payment cards on this website?
No. Payment card data is not processed on this website.
Get started