Security

AdFunnl holds your connected ad accounts, your store data and your clients' numbers. This page describes the controls that protect that data: how accounts are secured, how one workspace is kept separate from another, and how credentials are stored.

Passwords are hashed with bcrypt, never stored in plain text. Sign-in and password-reset attempts are rate-limited to stop automated guessing.

Signing out everywhere, or changing your password, immediately invalidates every existing session, not just the one you're using.

Every request is scoped to the workspace it belongs to. A member of one workspace cannot read, list or act on another workspace's clients, ad accounts or dashboards, regardless of ID guessing or URL editing.

Within a workspace, a member restricted to specific clients only ever sees those clients' data, in the app and through the AI assistant and MCP access alike.

All traffic to and from AdFunnl runs over HTTPS.

OAuth tokens for every connected platform, Meta, TikTok, Snapchat and Google, plus Shopify and Salla, are encrypted at rest with AES-256 before they reach the database. A database copy alone does not expose a usable credential.

AdFunnl staff do not have standing access to workspace data. Support access is a separate, narrow permission, granted to specific accounts and auditable, not a side effect of working at AdFunnl.

AdFunnl runs on Railway. Production access is restricted to authorized personnel.

If you believe you've found a security issue in AdFunnl, contact us at the address below with what you found and how to reproduce it. We respond to every report.