Security & Safety
Your AI managers, powered by Claude, read and analyze your accounts freely. But every change, every ad, every budget, every word that goes out, waits for your approval first. That rule is built into how they work, not written in a policy.
How a change ships
Your manager studies your account, your spend, and your results. Reading is always safe. It changes nothing.
When it finds an improvement, it prepares the exact change as a draft, a dry-run you can inspect line by line.
You see what will change, what it costs, and why. Nothing moves until you approve it.
Only after your approval does the change go live, and it still passes the spending guardrails on the way out.
What is running today
Everything on this page is shipped and running now. Plain descriptions, no fine print.
Nothing is published, sent, or changed on an ad account until you explicitly approve it. Drafts and dry-runs are as far as a manager can go on its own. The final yes is always a human one, and it is always yours.
Applies to every outward action: ads, budgets, emails, posts, and account settings.
Every write to an ad account passes a spend-cap check and a deny-by-default list before it runs. If a check cannot run, for any reason, the action is denied. When in doubt, the answer is no.
A broken safeguard stops the action. It never skips the check.
The keys that connect your ad accounts are encrypted before they are stored, a separately sealed secret for each customer. They are never saved in plain text.
Fernet symmetric encryption, applied before anything reaches the database.
If the service finds itself in an unsafe configuration, it refuses to boot rather than run with weak settings. Its database role also runs without superuser bypass, so even our own code has no shortcut around its limits.
Startup checks run before a single request is served.
Every account manager reads and analyzes freely, but stages any change as a reviewable dry-run. Analysis is unlimited. Action always waits for you.
The same rule for every manager, on every connected account.
The principle underneath
Many services fail open: if a safeguard breaks, actions slip through. AdvisorPPC fails closed. If the spend-cap check cannot run, the write is denied. If the configuration looks unsafe, the service will not start. A broken safeguard stops work. It never skips the check.
Straight answers
Connect an account and watch them analyze it. Nothing changes until you approve it.
Questions about security? Write to hello@advisorppc.com.