Security

Where your data lives

• Database and files: Supabase, in the EU (Frankfurt).
• The app itself: runs on Vercel, with its server functions in Frankfurt.
• Everyone else we use – AI models, payments, email – is listed with its role and location in our privacy policy. We send each one only what its task needs.

Businesses are kept apart

• Every table that holds a business's data has row-level security in the database: a signed-in person can read only the businesses they belong to.
• Every action on the server checks, again, that the person belongs to that business and may do that particular thing – members, owners and our own operators have different rights.
• Automated tests check both on every change before it can go live.

Your ad account

• Access to your Meta ad account uses a token that is encrypted at rest (AES-256-GCM); it is decrypted only at the moment it is used.
• You can take access back at any time in your Facebook or Meta Business settings – no need to ask us.
• Card details never reach us: payments go through Stripe.

What the agent can and cannot spend

• Every campaign is built paused. Nothing is spent until a person with the right to launch clicks the button.
• A daily limit per business – a campaign over it is refused when it is built, and the daily check pauses a campaign the agent manages if it spent past it.
• An emergency brake: one click pauses everything on the account.
• The agent may pause on its own (pausing only reduces spend) – never start, raise a budget or publish on its own.

What has not been done yet

• No independent penetration test so far. When one is done, its date and a summary of what it found will appear here.
• No certification such as ISO 27001 or SOC 2. We would rather say so than suggest otherwise.

Found a problem?

Write to info@pilgud.com with "Security" in the subject. Tell us what you found and how to reproduce it; please don't access other people's data or disrupt the service while testing. We answer within two working days.