Analysis mode
Read-only retrieval, comparison, diagnosis, monitoring, and reporting run only after identity, organization membership, provider authorization, and exact account scope resolve.
Security follows the authority chain
Access only what was authorized. Stop when evidence is missing.
ChatGrowing connects authorized data from Google Ads, Meta Ads, TikTok Ads, AppsFlyer, and other supported advertising and analytics services. It separates identity, connected data, generated work, delivery, and advertising actions so each step resolves to an organization, an authorized member, an allowed capability, and an exact resource scope.
Action mode
Supported advertising changes use separate write authorization and an action boundary with account scope, approval, idempotency, preconditions, audit, limits, and emergency stop controls.
Control model
Six checks before trust becomes access.
Security is enforced through explicit identity and resource relationships, not inferred from a prompt, a familiar account name, or a previously cached result.
Verified member
Authentication establishes a user identity. Organization membership, role, and capability grants determine what that identity may request.
Exact scope
Connections and account selections are bound to specific organizations and advertising resources. Similar names do not create access.
Separated secrets
OAuth codes, refresh tokens, client secrets, and developer tokens stay outside prompts, reports, artifacts, ordinary logs, and browser responses.
Tenant boundary
Queries, snapshots, caches, evidence, reports, and delivery state carry tenant and resource context so one workspace cannot silently fall back to another.
Traceable results
Requests retain source, scope, data timing, query state, and trace evidence so partial, stale, unavailable, and true-zero outcomes remain distinguishable.
Fail closed
If identity, scope, credential context, provider state, or data health cannot be verified, the operation stops or returns a typed limitation instead of guessing.
Data protection
Keep credentials narrower than the work.
A user-facing result needs advertising evidence, not the secret that retrieved it. ChatGrowing’s architecture keeps credential material behind controlled provider adapters and exposes only the minimum state needed to understand a connection.
No certification claim. This page describes product controls and engineering requirements. It does not claim SOC 2, ISO 27001, Google verification, a completed third-party penetration test, or a security assessment unless ChatGrowing publishes separate evidence.
TransportHTTPS and TLS
StorageServer-side secret boundary
Application referenceOpaque credential reference
Provider callExpected tenant context
User resultNo token material
RevocationConnection fails closed
Operational safeguards
Security continues after authentication.
Authentication is one control. Safe operation also requires isolation, release discipline, observability, recovery, and a way to revoke access.
Network and transport
Public traffic uses HTTPS. Production edge-to-origin transport is configured for strict certificate validation. Internal services should expose only the narrow routes required by their callers rather than public database or secret access.
Least privilege
Web, plugin, reporting, synchronization, and analysis responsibilities use bounded capabilities. Analysis mode and the Ads Read MCP do not receive advertising write authority; action mode uses a separate write-capable service boundary. Service identities and provider scopes are limited to the work they perform.
Tenant isolation
Organization membership, resource bindings, connection context, data-plane selection, artifact access, and report delivery are checked together. Cross-tenant identifiers, mismatched credential context, or missing scope block the request.
Logs and audit
Operational records use trace identifiers and security events while credential-shaped fields are redacted. Published evidence and reports preserve useful lineage without turning a report or artifact into a secret store.
Backups and recovery
Backups, release manifests, integrity checks, retention, and restore drills are treated as separate controls. A healthy service process alone does not prove recoverability. Commercial tenant recovery must preserve the same permission boundaries after restore.
Monitoring and response
Availability, data freshness, provider failures, authorization state, certificate health, storage capacity, and suspicious access patterns can trigger investigation or a safe stop. Confirmed incidents are contained, investigated, remediated, and communicated when required.
Deletion and revocation
Revocation prevents new authorized access. Deletion is a separate lifecycle that covers eligible credentials, bindings, active data, caches, artifacts, and reports while allowing limited legal or security records to age out under their retention policy.
Release discipline
Production changes should come from reviewed, reproducible releases with validation and rollback evidence. Test fixtures, local success, and service health are not treated as proof that a customer’s real authorization or data path works.
Action safety
Higher-risk work gets a separate gate.
ChatGrowing provides action mode while keeping write authority separate from analysis access. The action service applies controls appropriate to the provider, advertising account, action type, risk, and customer policy.
CandidateExact proposed change
AuthorityAllowed account + action
PreconditionCurrent provider state
ApprovalPolicy or reviewer decision
ExecutionIdempotent action identity
RecoveryRollback or compensation
Illustrative policy
Different work can use different autonomy.
A report may refresh automatically while a campaign launch waits for review. Action availability and approval requirements vary by provider, account authorization, workspace configuration, and plan.
Move budget toward qualified growth, but ask before launching a new campaign or pausing an existing one.
ChatGrowingEvaluating the policy✓ Resource scope checked✓ Preconditions evaluated✓ Approval boundary applied
ILLUSTRATIVE POLICY RESULTRoutine changes stay inside the configured guardrails. A material launch remains queued for an authorized reviewer.
Shared responsibility
Customers control who and what they connect.
Workspace owners are responsible for member access, provider permissions, selected advertising accounts, destination access, approval policies, and removing access when it is no longer needed. Users should never paste credentials into a ChatGrowing prompt.
Report a concern. Send security or privacy concerns to [email protected]. Do not include passwords, access tokens, OAuth codes, client secrets, or developer tokens. For account disconnection and deletion, follow the data deletion and revocation process.