Security

How we protect your data and ad accounts

1. OAuth Permissions

OpenAdManager uses Facebook's OAuth 2.0 protocol for secure authentication. We request only the permissions necessary to provide our service:

  • ads_read: View your ad campaigns, performance metrics, and account structure
  • ads_management: Create, edit, pause, and manage ad campaigns on your behalf
  • business_management: Access business account information for multi-account management

We never request access to your personal messages, friends list, or other personal Facebook data. You can review and revoke permissions at any time from your Facebook Settings > Apps and Websites.

2. Data Handling

  • Minimal Data Collection: We only store what is needed to provide the service (account info, campaign data, performance metrics)
  • No Password Storage: Your Facebook password never touches our servers. Authentication is handled entirely by Facebook's OAuth system.
  • Token Security: OAuth access tokens are encrypted at rest and stored in secure, access-controlled databases
  • Data Isolation: Each user's data is isolated and inaccessible to other users
  • Regular Cleanup: Expired tokens and unnecessary data are regularly purged

3. Encryption & Infrastructure

  • In Transit: All communication uses TLS 1.2+ encryption (HTTPS everywhere)
  • At Rest: Sensitive data including OAuth tokens and API keys are encrypted using AES-256
  • Infrastructure: Hosted on secure cloud infrastructure with DDoS protection, firewalls, and intrusion detection
  • Access Control: Strict role-based access control for all systems and databases
  • Monitoring: 24/7 security monitoring and automated alerts for suspicious activity

4. Compliance

  • We follow Meta's Platform Terms and Developer Policies
  • Regular compliance reviews ensure we meet Meta's data handling requirements
  • We respect GDPR rights including data access, portability, and deletion requests

5. Disconnecting Your Account

You can disconnect OpenAdManager from your Facebook account at any time:

  1. Go to Facebook Settings > Apps and Websites
  2. Find OpenAdManager and click "Remove"
  3. Contact us at support@openadmanager.com to request full data deletion

Once disconnected, we will no longer have access to your Facebook ad accounts. Any cached data will be deleted within 30 days.

6. Security Concerns

If you discover a security vulnerability or have concerns about your account security, please contact us immediately at support@openadmanager.com. We take all security reports seriously and will respond within 24 hours.