# Security

> The connected assistant never holds an ad platform token: it talks to the gateway, the gateway talks to the platforms.

Last reviewed: 2026-08-29. The machine-readable version of this page is at
https://www.getmcpads.com/security.json.

## Tokens

- Ad platform tokens are encrypted at rest with AES-256-GCM and never leave the server.
- Revoking an assistant's access happens in the dashboard and does not require rotating any platform credential.

## Authentication

- OAuth 2.1 with PKCE (S256), dynamic client registration (RFC 7591), protected resource metadata (RFC 9728).
- No static API keys exist for the MCP surface.

## Account scoping

- Per ad account, not per connection. Only accounts explicitly ticked in the dashboard are reachable.
- Server side, on every call, including calls routed through run_tool. Nested account identifiers in arguments are checked too.

## Safe Writes

- Every write returns a description of the change and stops. Applying it requires a second call with confirm set to true.
- Campaigns are always created paused. There is no option to create them active.
- The Free plan announces no write tool and refuses any write call.

## Data

- Advertising data: Never stored: answers stream from the platform APIs to the assistant.
- Stored: __session, __client_uat (cookie): Keeps you signed in, so the dashboard does not ask again on every page.; gma_org (cookie): Remembers which organisation you are looking at, when you belong to more than one.; oauth state (cookie): Ties an advertising platform's authorisation response to the request you started. Without it, the flow cannot be verified.; sidebar:state (cookie): Remembers whether you collapsed the sidebar.; theme (local storage): Remembers whether you chose light or dark.; gma_consent (local storage): Remembers your answer about analytics, so we do not ask again.; Vercel Web Analytics (local storage): Counts page views and where visitors come from. No cookie, no cross-site identifier, no profile..
- Retention: Your account and organisation: For as long as the account exists. Deleting the account removes them, and an organisation left with nobody in it is removed with it.; Advertising access tokens: Until you disconnect the platform, or the platform revokes them. Disconnecting deletes the row rather than marking it revoked.; Advertising data itself: Never stored. Campaigns, spend and performance are read from the platform on demand and passed straight to your assistant.; Usage counters: Thirteen months, so a year-on-year comparison is possible. They hold a count, not a query.; Invitations: Kept as a record of who was invited and when. The link itself is stored only as a hash and is never recoverable..

## Sub-processors

- Vercel: Hosts the website and the dashboard. (Edge in Paris, functions in Virginia (iad1).)
- Neon: PostgreSQL database. (AWS us-east-1, Virginia.)
- Cloudflare: Runs the MCP gateway and serves DNS. (Nearest edge location. Requests from Europe are served in Europe.)
- Clerk: Sign-in, sign-up, password reset and session management. (United States.)
- Resend: Sends transactional email: invitations and the welcome message. (AWS eu-west-1, Ireland.)

## Human-only boundaries

- Granting OAuth consent on an advertising platform.
- Choosing which ad accounts to expose.

These are not exposed as agent capabilities at all: the boundary is architectural, not advisory.