Security

1. Encryption in Transit and at Rest

Data in Transit: All communications between your browser, our API endpoints, and third-party services are encrypted using modern Transport Layer Security (TLS 1.2 and TLS 1.3) with strict HTTP Strict Transport Security (HSTS) headers.

Data at Rest: Application data stored in Amazon DynamoDB, S3, and parameter stores is encrypted at rest using industry-standard AES-256 encryption managed via AWS Key Management Service (KMS).

2. Cloud Infrastructure & EU Data Residency

AdsDoneEasy runs entirely on Amazon Web Services (AWS) infrastructure situated in the AWS Region eu-central-1 (Frankfurt, Germany).

Our serverless architecture eliminates persistent unpatched server instances, utilizing isolated AWS Lambda execution environments with ephemeral storage.

3. Google Ads OAuth Security & Token Isolation

Google Ads account integration uses official Google OAuth 2.0 with minimal required permission scopes (ad management only; no Google account administration rights).

Sensitive refresh tokens are never exposed to client browsers or stored in frontend databases. They are stored in encrypted AWS SSM Parameter Store storage with strict IAM policy boundaries.

You can revoke platform access to your Google Ads account at any time directly in your Google Security settings.

4. Identity, Access Management, and Web Protection

Authentication is powered by Amazon Cognito, providing secure JWT token issuance, rate limiting, and passwordless authentication options.

Our web application enforces Content Security Policy (CSP) headers, anti-clickjacking headers (X-Frame-Options), and automated SSRF prevention guards.