Legal & Compliance

Security

Last updated: September 30, 2026

How we protect the data you trust us with.

Read-only access

Platform connections request read-only permissions. BenchMarketing cannot change your campaigns, budgets, or billing on any ad platform.

Encryption

All traffic uses HTTPS, with HTTP Strict Transport Security.
Platform access and refresh tokens are encrypted with AES-256-GCM before they are stored, using versioned keys held outside the database.
Our database provider encrypts data at rest.

Access controls

Workspaces use roles (owner, admin, manager, analyst, viewer). Only owners, admins, and managers can connect or disconnect platforms. Our staff do not access your workspace data except to provide support you ask for, to investigate security issues, or where the law requires.

Abuse protection

Sign-in, APIs, and public forms are rate limited, and the data API uses scoped keys.

Reporting a vulnerability

Email security@benchmarketing.org. Please give us reasonable time to fix an issue before disclosing it.