Security & trust
Understand the permissions, safeguards and access controls behind your connected advertising accounts.
Clear boundaries.
Explore an explanatory permission model. Review the published specifications below.Review the requested access for each integration. Reading a report and changing a campaign are different permissions.
Know what you authorize.Supported campaign changes depend on the permissions and controls enabled for your account.
Your settings matter.Ask the team for the documents and account-specific details you need for your security review.
Go beyond an overview.The foundations
Review each platform’s authorization screen. Some integrations request broad scopes; actual reads and writes depend on the feature and account configuration.
Ask for the storage, transport, backup and access-control evidence relevant to your deployment. This page does not certify encryption settings or per-customer keys.
Supported workflows record activity for review. Coverage and retention vary; this is not a guarantee of an immutable log of every action.
Stripe handles subscription payment collection. Connected payment metadata is separate from card collection. A provider’s certification does not certify Omesta or remove our own obligations.
Review the scopes for every integration. Supported campaign actions depend on platform permissions and the controls enabled for your account.
Architecture
| Review area | Evidence to request |
|---|---|
| Storage and backup safeguards | Request deployed configuration and provider evidence |
| Transport security | Review the relevant endpoints and provider configuration |
| Keys and privileged access | Request the applicable access and key-management details |
| Retention and deletion | Agree the scope and deadlines; disconnect is not erasure |
Access & oversight
Team roles, AI tools and expressly agreed human ad management have different access needs. Review permissions and provider context for enabled features. A preview approval card or workspace switcher is not evidence of deployed authorization or tenant isolation.
The new production-credit wallet, top-ups, auto-refill and media pipeline are planned. Payment authorization, spending caps, duplicate-job handling, file access and provider deletion require implementation and testing before launch; this page does not certify those controls as live.
Campaign automation, conversion forwarding and audience uploads are separate workflows. Account connection is not an individual’s advertising consent. Reversal of a change or transfer is not guaranteed.
Review connection controls and revoke access with the source platform when needed. Disconnecting does not itself erase historical records or copies already sent elsewhere.
Customer-scoped access and privileged support access need separate review. We do not claim a dedicated database for each customer or an absence of administrative access.
Ask which independent reports, if any, are available and which entity and service they cover. We do not claim an Omesta SOC 2 report or ISO certification on this page.
A DPA draft is not an executed agreement or proof of GDPR compliance. Required controls, provider terms and transfer arrangements must be verified before covered processing. EU-only residency is not promised.
Contact support@omestasystems.com for a security review or to report a concern. Do not include passwords, API keys or unnecessary personal data in your report.
Documentation
No Omesta certification or audit report is asserted here
Depend on processing, jurisdiction and implemented controls
Require review and execution before covered processing
Review supported sources, data categories and feature-specific transfers.
Request the status of the DPA and any required international-transfer arrangements.
Ask for available, current evidence. No completed penetration test is asserted here.