Trust & compliance
Nothing runs without guardrails
Automation that touches live budget and customer data has to be defensible — to your CFO, your legal team, and your board. This page is the whole answer: what we commit to in writing, how the architecture enforces it, and the privacy and AI rules your marketing data already lives under.
Four things we put in writing.
Not aspirations — these are commitments we make contractually, and every one of them is a question your security team is going to ask anyway.
Read-only by default
We start with read-only credentials on your ad and analytics accounts. Write access is requested per workflow, only where an automation genuinely needs it, scoped to that job — and revocable by you at any time, without breaking what we have already built.
Your data never trains models
Your campaign data, CRM records and strategy documents run your workflows and nothing else. We do not use client data to train or fine-tune models, and we never pool one client’s data into another client’s environment.
You own everything, and it exports
Workflows, guardrail configs, prompt packs, agent instructions and audit logs are yours. They live in your environment, they export in full, and if the engagement ends the system keeps running without us. No seat licence to cancel, no dashboard to lose.
We sign your paperwork
We will sign your DPA, MSA and security addenda, and complete vendor security questionnaires — SIG, CAIQ, or whatever format your procurement team requires. Send it over and we fill it in.
Nobody climbs a tower they don’t trust.
Guardrails are the product, not a setting.
Trust is not a promise made in a sales meeting — it is a property of how the system is built. Every automation we stand up runs inside limits your team defines before it is switched on, and writes down what it did afterwards.
- Spend caps — a hard ceiling on what any automation can move, per day and per account.
- Change ceilings — limits on how far a single setting can shift in one step, so nothing swings wildly overnight.
- Approval thresholds — routine changes execute and get logged; large or unusual ones stop and wait for a human.
- Audit trail — every action recorded as Trigger, Action, Impact: what fired it, what changed, what moved as a result.
- Reversibility — changes are designed to be undone cleanly, not excavated out of a change log.
- Human judgment where it matters — creative, cultural and strategic calls stay with people, by design.
The mechanics are documented publicly rather than held back as proprietary mystery: bounded autonomy, how guardrails work, the audit trail, approval thresholds, and why every change must be reversible.
The red tape your marketing data already lives under.
Most of this applies to your marketing whether or not you automate it — automation just makes it visible, and makes non-compliance scale faster. Here is the landscape we design around, and what each one actually asks of a marketing team.
Orientation, not legal advice — your counsel owns the final call on what applies to you.
Privacy & data protection
Marketing communications
AI-specific rules
Platform & contractual rules
The frameworks your buyers audit against
Primary sources: EU AI Act (European Commission) ↗ · PIPEDA (OPC) ↗ · CASL ↗ · CCPA (California AG) ↗ · NIST AI RMF ↗
We will not claim a badge we have not earned.
We are actively working toward SOC 2 and ISO certification. We are not certified today, and you will not find a logo on this page pretending otherwise — which is exactly the standard we would want you to hold any vendor to, including us.
In the meantime we build to the same control areas those audits examine: least-privilege access, change management, logging and monitoring, incident response, and vendor management. We will walk your security team through how each one works today, in detail, and complete your questionnaire in your format.
Ask for our current status →The underlined items are published at /trust/data-practices — read them before you ask.
The questions your security team will ask.
Do you need access to our ad accounts?
We start read-only. The Automation Audit runs entirely on read-only access to your ad and analytics accounts — we can look, we cannot change anything. Write access is requested per workflow, only when a specific automation needs it, scoped to that job, and revocable by you at any time.
Is our data used to train AI models?
No. Your campaign data, CRM records, strategy documents and business context are used to run your workflows and nothing else. We do not use client data to train or fine-tune models, and we never pool one client’s data into another client’s system.
Are you SOC 2 or ISO certified?
Not yet, and we will not claim otherwise. We are actively working toward SOC 2 and ISO certification, and in the meantime we design to the same control areas those audits cover — access control, change management, logging and monitoring, incident response, and vendor management. We are happy to walk your security team through exactly how each control works today and to complete your vendor security questionnaire.
Who owns what you build?
You do. Every workflow, guardrail configuration, prompt pack, agent instruction and audit log we produce is your property, documented in your environment and exportable in full. If the engagement ends, the system keeps running without us — there is no seat licence to cancel and no dashboard you lose access to.
Will you sign our DPA and complete our security review?
Yes. We will sign your Data Processing Agreement, master services agreement and security addenda, and complete standard vendor security questionnaires such as SIG and CAIQ. If your procurement team has a required format, send it over and we will fill it in.
Built by partners you can check.
Start with the free Readiness Score to see which parts of your marketing can safely run autonomously — then the Audit maps it against your real accounts, read-only, nothing changed.