Security

You’re trusting us with information about your ad account. This page explains how we protect it.

The scan only reads

• Our free scan is a short script you run inside your own Google Ads account. Its only Google Ads calls read reports and your account’s currency and time zone. It contains no commands that change your account, and an automated test blocks any such command from ever being added.
• You can read every line before you run it.
• Each script carries a one-time code. It works once and expires after 24 hours.

We keep as little as possible

• We never receive your Google password or a key to your account.
• We don’t keep the raw data the script sends. We keep only what your report shows: totals and each finding with the numbers behind it.
• Report links are long, random and impossible to guess, and they stop working after 30 days. Report pages are never shown in search engines.

How data is protected

• In transit: every connection to SpendCanary uses HTTPS.
• At rest: our database runs on Cloudflare D1, which encrypts all stored data (AES-256).
• Secrets: passwords and keys for our providers are stored as encrypted secrets, never in our code.
• Logs: our logs automatically remove email addresses, tokens and keys before anything is written.
• Abuse protection: our forms are protected by Cloudflare Turnstile and rate limits.
• Browser security: our pages use a strict Content Security Policy and can’t be embedded in other sites.

Who can see your data

Only the people who run SpendCanary, and only when needed to support you or keep the service running. Our providers (see the privacy policy) handle data only to provide their service to us.

Report a security problem

If you think you’ve found a security issue, please email support@spendcanary.com with “Security” in the subject. Please give us a reasonable chance to fix it before telling anyone else. We’ll reply and keep you updated.