Security & Data Protection

Data in Transit: All traffic is served over HTTPS with TLS 1.2+ encryption. This includes the dashboard, all API routes, and Meta API communications. We enforce HTTPS across the entire application — unencrypted HTTP connections are rejected.

Password Security: Passwords are hashed with bcrypt (cost factor 12) before storage. We never store plaintext passwords anywhere. Minimum password strength is enforced at registration.

User sessions are managed by NextAuth.js using signed, server-side JWT tokens. Email verification is required before any dashboard access is granted. Meta account connections use the standard OAuth 2.0 authorization code flow — we never receive or store your Facebook or Instagram password. Tokens can be revoked at any time from your dashboard.

Adams Analytics is hosted on OVH VPS infrastructure in France with a MySQL database. The server runs under a dedicated non-root user with firewall rules restricting access to only necessary ports. API routes are protected by server-side session verification on every request. Database access is exclusively through Prisma ORM with parameterized queries, preventing SQL injection by design.

Every API request verifies your session and loads only your own data. Multi-tenant row-level isolation is enforced in all database queries — your data is never accessible to other accounts. Admin access requires a separate isAdmin flag stored in the database and is audited. We never sell or share your advertising data with third parties.

Read-Only Permissions Only: We request only ads_read, pages_read_engagement, and instagram_basic. We never request write permissions and never modify your campaigns, budgets, or ad accounts.

Token Storage: Meta OAuth access tokens are stored encrypted in the database and used server-side only — they are never exposed to the browser or included in client-side responses. Tokens are immediately invalidated in our system when you disconnect your account.

If you discover a security vulnerability, please report it responsibly to support@buildincairo.com. We take all security reports seriously and respond within 24 hours. In the event of a data breach affecting your account, we will notify you promptly with details, scope, and recommended actions.