Authorization scope
Provider permissions and account roles determine which businesses, managers, and ad accounts are reachable.
Security and controls
Account access should be explicit. Live changes should be deliberate.
AdvisorPPC uses platform authorization, encrypted credential storage, narrowly scoped tools, and confirmation boundaries to reduce avoidable PPC account risk.
How AdvisorPPC accesses advertising accounts
Users authorize Google or Meta through the provider's OAuth flow. AdvisorPPC receives tokens, not the user's Google or Meta password, and uses those tokens only to call the relevant provider API for authorized requests.
Stored platform tokens are encrypted at rest using the application's credential-encryption layer. Transport to the public service uses HTTPS. Users can revoke platform access through the provider and remove connected access from AdvisorPPC.
Control layers
Several boundaries work together.
Focused public tools
The ChatGPT-facing product exposes a limited, reviewable set of Google and Meta workflows instead of a generic private dispatcher.
Account context
Manager and child-account discovery reduces the risk of applying a request to an unintended customer.
Read operations and write operations
| Operation type | Examples | Control |
|---|---|---|
| Read | List accounts, list campaigns, retrieve performance, analyze search terms | Requires an authenticated user, eligible paid entitlement, and connected provider access |
| Write | Pause or enable a campaign, replace a Google campaign budget | Target and change must be explicit; confirmation is required before execution |
| Draft creation | Create a paused Meta campaign draft | Created paused by default so delivery does not begin automatically |
What “secure” does not mean
No internet-connected service can promise zero risk. AdvisorPPC does not claim that AI recommendations are infallible or that OAuth removes the need for careful account administration. Customers should use least-privilege roles, review access regularly, maintain conversion-tracking quality, and confirm high-impact decisions with an accountable specialist.
MCP connection controls you can check
Every control below runs today. Each row says how you can see it for yourself.
| Control | How to check it |
|---|---|
| OAuth 2.1 with PKCE (S256 only) and issuer in the response | /.well-known/oauth-authorization-server lists code_challenge_methods_supported: ["S256"] |
| Tokens bound to one endpoint (RFC 8707); 60-minute access tokens; refresh tokens rotate on every use | /.well-known/oauth-protected-resource/mcp; an unauthenticated request to /mcp answers 401 with that document in WWW-Authenticate |
| Consent names what is granted and which accounts it reaches | The sign-in screen, before you approve |
| Agent keys: scoped per platform, expire within 365 days, revocable, rate limited, stored only as a keyed hash | Connected agents shows each key's scopes, expiry and last use |
| Every connected app listed with Revoke; an account switch turns MCP access off at once | Connected agents |
| Tool-call log by session: tool, outcome, time; never arguments or results; kept 30 days | Connected agents, recent tool calls |
| Irreversible removals need written confirmation and wait in a cancellable window | The tool tells you before anything is removed |
| Which code is running | /healthz reports the deployed commit |
What we do not do
- We do not use your data to train AI models, ours or anyone else's.
- We do not sell your data.
- We do not scrape consumer apps or automate provider web interfaces; every call uses the provider's official API under your authorization.
- We do not make changes on our own schedule: every change runs inside a tool call you or your agent made. Automation rules you create act only when a tool call evaluates them.
- We do not hold security certifications today, and we do not claim any.
Reporting a concern
Send security, access, privacy, or deletion requests to support@advisorppc.com. Include the affected workspace and a description, but never send passwords, access tokens, or API secrets by email.