Security
What we can reach, and what we cannot.
You are weighing whether an automated system might change something expensive while you are not looking. We read your account and write nothing back until you approve a specific operation.
Anything this page does not cover — security@goldbeater.ai
- Read-only
- until you approve an individual operation
- 0 keys
- where the analysis runs. Your Google access stays on our server
- 0 rows
- of your performance data kept after a review
- Undo first
- or the change is refused before anything is sent
The boundaries
Four boundaries, and the thing in the code that holds each one.
A claim without a mechanism is a promise, and a promise is not a control.
We cannot read anyone else's account
The account a query runs against is attached by our own server, from a token minted for that run. The query language has nowhere to name an account, so no string the agent writes can reach a different one.
Your credentials never leave our server
The analysis runs in a sandbox that holds no credential of any kind and can reach exactly one address: our own server. Your Google access and our developer key stay behind it.
Nothing changes without a way back
A change set is a proposal until you accept operations inside it one at a time. We check it with Google first, refuse to send anything unless the undo has been written, then re-read the fields to confirm it did what it said.
Nothing in your data can give us orders
Search terms are what members of the public typed into a search box, and some of it is written to be read by a model. It arrives as data, kept apart from the instructions the agent follows — and there is no write path without your approval, so the worst outcome is a proposal you reject. There will not be an autopilot mode.
What we hold
We keep the conclusions and the conversation. We never keep a copy of your account.
Every review reads the live account and lets what it pulled expire. What stays is the part you would want back — the findings, the scorecards, and your decisions.
| What | Where it lives | How long |
|---|---|---|
| Performance rows pulled for a review | Working files in object storage | Expire automatically after the run |
| Findings, scorecards and their history | Our database | While your account is open |
| Change sets, the decisions you made, and the undo for each | Our database | While your account is open |
| Conversation transcripts and tool calls | Object storage, referenced from the database | While your account is open |
| Google OAuth refresh token | Encrypted under a managed key | Until you disconnect the account |
| Your name, email, organization | Our database | While your account is open |
| Card details | Stripe — never on our servers | Per Stripe's retention |
- A copy of your Google Ads account — every review pulls its own.
- Your Google password. Access is a grant you make at Google, and revoke there.
- Raw performance rows beyond the life of the run that pulled them.
- Any customer's data in a model provider's training set.
Subprocessors
Everyone who touches your data, and why.
This is the current list, and this page is where we keep it.
| Processor | What it does | Region |
|---|---|---|
| Cloudflare | Our API, the agent, the database, storage and the analysis sandbox | United States |
| Vercel | Serves this website and the product front end | United States |
| Anthropic | The model that reads the summarized account data and writes the analysis | United States |
| The Google Ads API — the origin of your account data, reached only through our proxy | United States | |
| Stripe | Billing and card handling | United States |
What reaches a model provider is the summary the checks produced, not a copy of your account. It never trains their models.
Found something? Tell us before you tell anyone else.
Write to security@goldbeater.ai. A human replies within two business days.