Security and controls
What the agent can and cannot do to your ad accounts
PaidSync lets an AI agent execute in live ad accounts, not just recommendations, across 14 platforms and 460+ tools through one endpoint, https://mcp.paidsync.ai/mcp, signed in with OAuth 2.0. Every write is approval-gated. It is held as a card before it runs, previewed with dry_run, and destructive operations need confirm_destructive. Applied changes get a one-tap undo and a 7-day outcome check. For an enterprise review, this page lists what is enforced in code and what is not built yet.
The approval model
Every change is a card before it is a change
When an agent decides to change something, the change is written as an approval card. The card shows the account, the tool, the arguments and the expected effect. A person taps Approve, and only then does the write run. That is the default for every agent, in chat, in a scheduled check and in the specialist agents in the workspace.
Two switches sit above the card. A brand-level kill switch in the brand safety settings pauses every automatic change for that brand. Above it is a platform-level gate that fails closed. Automatic execution is allowed only when the gate record exists, explicitly enables this environment, and is not frozen. A missing record, a corrupt value, a freeze or a read error all block. Blocked changes are queued as cards, never dropped, so a freeze costs taps rather than work. A person tapping Approve is exempt from the gate, because the tap is the authorization.
Some tools never run on their own, in any band, including full auto. This list is copied from the code that enforces it.
- apply_* campaign launchesA new campaign lands only after a person confirms the target account.
- apply_bundleA bundle exists to put many changes behind one approval, so it cannot self-approve.
- create_image_asset, upload_fb_ad_image, upload_fb_ad_videoNo creative lands on an account without a tap.
- apply_recommendation, subscribe_to_recommendationsGoogle requires a person to review and edit before a recommendation is applied.
- set_device_bid_adjustment, set_location_bid_adjustment, add_audience_targetingBid and targeting moves that shift real money.
- remove_campaign, remove_product_partition, exclude_product_partitionPermanent in Google Ads.
- paidsync_exec, paidsync_workflows_run, paidsync_workflows_save, paidsync_workflows_deleteArbitrary code and saved workflows always go through a person.
- create_account, create_account_under_mccAccount provisioning is billable and never automatic.
- run_mutateThe raw Google mutate call carries a payload the spend checks cannot inspect.
- delete_*, remove_*, destroy_*Any tool whose name contains delete, remove or destroy, on any platform.
A dynamic tool the classifier cannot place is denied by default. It becomes a card or it does not run.
Before a write runs
Six checks between the agent and the platform
These run on every mutation, whether the request came from Claude, ChatGPT, a scheduled check or the workspace. They are part of the tool runtime, not a setting a user can turn off.
Dry run first
Create tools default to
dry_run. The first pass returns what would be created, with the account and the numbers, and touches nothing. The live pass is a second, explicit call.Pre-write rule validator
Before any write, the arguments are checked against the rule set for that platform. A rule marked block stops the call and returns the reason. A rule marked warn lets it through and attaches the warning to the result. Overriding a block requires an explicit flag, and every override is logged.
Explicit confirm on destructive tools
Delete, remove, pause, disable and revert tools, budget updates and the raw Google mutate call all require
confirm_destructive. The bulk form of an action is gated the same way as the single form.Money check on the account
Each run is anchored to one account per platform. If a mutation names a different account, the runtime refuses it before the API is called. The error names both accounts so the person can re-anchor on purpose.
Spend ceiling
A daily budget above the ceiling derived from your Brand Brief is queued for approval instead of applied. The ceilings are described below.
Kill switches
The brand switch and the platform gate are read on the same path. If either says stop, the change becomes a card.
After a write runs
Read back, log it, keep the way back
A write that returns 200 is not proof the platform holds what you sent. So the runtime reads the changed object back and compares the fields that matter. A mismatch is reported as a failed write, not a success.
Change log
Every live mutation is written to a change log with the user, the account, the tool, a summary of the arguments, the source and the actor. Dry runs are not logged, because nothing changed. You can read it in the product or ask the agent through
get_operator_change_log, which returns up to 100 rows with a before-and-after outcome on each.One-tap undo
Cards live on the workspace proposal board. When a card is applied, the inverse change is built at the same moment and stored on the card. Undo re-runs the inverse. Running it twice has no extra effect. Undo for a created campaign expires after 7 days. Where a platform has no safe inverse, the card says so rather than guessing.
No double execution
A card moves from pending to executing in one atomic step. Two people tapping at once produce one write.
7-day outcome check
A daily check measures each applied change 7 days later, or 2 days later for conversion-tracking installs, where the only question is whether conversions started flowing. Spend, conversions, CPA and ROAS are compared around the change.
Rollback card
If the outcome regressed by $50 or 20 percent, the check writes a rollback card for a person to approve. Automatic revert happens only when the brand has explicitly enabled it, enabled auto-revert, and set the coexistence mode to auto, and only for changes PaidSync itself made. A rollback never cascades into a rollback of a rollback.
Spend ceilings and autonomy bands
Trust is graduated, and the ceiling never comes off
Each agent runs in one of four bands. New agents default to propose. Audit and report agents default to observe. Only an admin or the workspace owner can move an agent into a band that executes on its own. Tool access is set server-side in three tiers per agent, read, propose and act, and the band narrows it. A client cannot widen it.
| Band | What the agent does | Who can set it |
|---|---|---|
| Observe | Reads and alerts. Writes nothing. Default for audit and report agents. | Any editor or above |
| Propose | Drafts every change as a card and waits. Default for every other agent. | Any editor or above |
| Act with guardrails | Executes inside the limits below. Never-auto tools still become cards. | Admin or owner |
| Full auto | Executes without waiting, still inside the budget ceiling and the protected-campaign list. Never-auto tools still become cards. | Admin or owner |
Daily ceiling from the Brand Brief
Your Brand Brief holds a monthly cap in total and per channel. PaidSync divides the cap by 30.4 to get a daily ceiling. A budget write above it is queued for your approval. A write at 85 percent or more of the ceiling carries an alert. The check keys on the presence of a budget amount in the arguments, not on the tool name, so a Meta budget setter is caught the same as a Google one.
Per-agent limits
Maximum actions per run defaults to 10 and is clamped at 100. Maximum budget per action defaults to one channel-day of spend when you leave it blank, so an acting agent never runs with no ceiling at all.
Brand limits
A brand can cap automatic changes at up to 20 per run and 50 per day. The waste-guard automatic path also honours a brand allowed-tools list of at most 10 tools, which defaults to pause only.
Hard in every band
Protected campaigns are never touched, and the budget ceiling applies in every band that acts, including full auto. Act freely means inside the envelope, not without one.
Scheduled checks
Scheduled agents, growth runs and the outcome check all go through the same executor and the same gate as a chat request. There is no second path with fewer checks.
Access and data
Your tokens, your roles, your deletion
OAuth per platform
You connect each ad platform yourself through that platform's own OAuth screen. PaidSync never asks for a platform password. Disconnecting a platform from the dashboard deletes its tokens. Clients such as Claude and ChatGPT sign in to PaidSync with OAuth 2.0 (dynamic client registration, PKCE) at https://mcp.paidsync.ai/mcp. An API key works for read-only use; applying a change requires the OAuth sign-in.
Encryption at rest
Platform tokens are encrypted at rest with AES-256-GCM. If you bring your own model key, it is encrypted with AES-256-GCM under a separate key-encryption key.
One account per session
Each session is bound to one active account per platform, set explicitly. A run cannot silently switch to another account, and the money check above refuses a mutation that tries.
Roles
Viewer, editor, admin and owner. Viewers read only. Editors and above can approve and undo a card, and the card records which user executed it. Admins and the owner set autonomy bands that execute on their own. One approval from an editor or above executes a card; there is no multi-step approval chain today.
What is stored from your ad accounts
A daily summary per connected account: the date, the account identifier, the currency, and that day's spend, impressions, clicks, conversions and conversion value. Keyword lists, ad text, audience lists and customer match data are not copied into this store. The full list of scopes and stored fields is on the privacy page.
Deletion
You delete your account from Settings. It is suspended and signed out at once, marketing email stops the same day, and you have 30 days to change your mind by signing back in. After 30 days the account data, the connected platform tokens and the authentication record are hard-deleted and the subscription is cancelled. Billing and usage records are kept for 7 years with your identifiers stripped and replaced by an internal reference, to meet tax record-keeping rules.
Sub-processors
The services the code calls
This list is derived from the hosts the product connects to, not from a policy template. If a service is not here, PaidSync does not send your data to it.
| Purpose | Service | What it receives |
|---|---|---|
| Ad platform APIs | Google, Meta, LinkedIn, TikTok, Microsoft, Snapchat, Reddit, Pinterest, X, OpenAI Ads | The reads and writes you ask for, on the accounts you connected |
| Model providers | Anthropic, OpenAI, Google Gemini, Groq | Your instruction and the data needed to answer it, in session |
| Resend | Transactional and account email | |
| Billing | Stripe | Payment details and invoices |
| Authentication and data | Firebase, Firestore | Account records, encrypted tokens, daily summaries, cards and logs |
| Hosting | Vercel, Google Cloud Run | The application and the agent runner |
| Website analytics | Microsoft Clarity | Usage of paidsync.ai, subject to your cookie choice |
| Internal alerts | Telegram | Operations alerts to the PaidSync team only. No customer ad data. |
Not yet
What is not built, stated plainly
A questionnaire is easier to answer when the gaps are already on the page.
- No general per-agent tool allowlist. Tool access is narrowed by the autonomy band and the three server-side tiers. The brand allowed-tools list applies only to the waste-guard automatic path.
- No audit export. The change log is readable in the product and through the agent, 100 rows per call. There is no CSV download, SIEM feed or webhook. Automation run history keeps the most recent 50 entries, and the proposal board and brand audit log list the most recent 50 entries too.
- No self-serve data export. Request a copy by email before deleting your account, as described on the privacy page.
- No independent audit report. No third-party security audit has been completed.
- Single sign-on is on request. Sign-in today is the PaidSync login with OAuth 2.0.
- A data processing agreement is on request. There is no published template to download today.
- No multi-step approval chain. One approval from an editor or above executes a card.
Vendor review
Questionnaire answers within two business days
Email your security questionnaire to support@paidsync.ai. You get written answers from the people who built the controls on this page, within two business days.
- Any format. A spreadsheet, a portal export or a list of questions in the email body.
- Every answer points at the control on this page or names the gap plainly.
- Larger builds with custom guardrails start on the enterprise page.
Frequently asked questions
Can the AI change our ad accounts without a person approving it?
Not by default. Every agent runs in one of four autonomy bands: observe, propose, act with guardrails, and full auto. New agents default to propose, so every change is drafted as an approval card and waits for a tap. Audit and report agents default to observe. Only an admin or the workspace owner can move an agent into a band that executes on its own, and even those bands keep the never-auto list, the spend ceilings and the protected-campaign list.
Is there a kill switch?
Two. A brand-level switch in the brand safety settings stops every automatic change for that brand. Above it sits a platform-level gate that fails closed: automatic execution is allowed only when the gate record exists, explicitly enables this environment, and is not frozen. A missing record, a corrupt value, a freeze or a read error all block. Blocked changes are queued as approval cards, never dropped. A person tapping Approve is not subject to the gate, because the tap is the authorization.
Which actions can never run automatically?
Campaign launches, bundles of changes, creative uploads, applying or subscribing to Google recommendations, device and location bid adjustments, adding audience targeting, removing campaigns or product partitions, arbitrary code runs, saving or running workflows, creating accounts, the raw Google mutate call, and any tool whose name contains delete, remove or destroy. These always become a card for a person, in every band including full auto. A dynamic tool the classifier cannot place is denied by default.
How are spend limits enforced?
Your Brand Brief sets a monthly cap in total and per channel. PaidSync divides the cap by 30.4 to get a daily ceiling. A budget write above the ceiling is queued for your approval instead of applied, and a write at 85 percent or more of the ceiling carries an alert. Each agent also has a maximum number of actions per run, 10 by default and never more than 100, and a maximum budget per action that defaults to one channel-day of spend. A brand can set its own caps of up to 20 changes per run and 50 per day. Protected campaigns and the budget ceiling are enforced in every band that acts, including full auto.
What happens before a write reaches the platform?
Create tools default to dry run, so the first pass shows what would happen without doing it. A pre-write validator checks the arguments against the rule set for that platform and blocks or warns before any call. Destructive tools, which includes delete, remove, pause, disable, revert, budget updates and the raw mutate call, require an explicit confirm flag. A money check refuses any mutation whose target account differs from the account the run was anchored to, before the API is called. The kill switches and the spend ceiling are checked on the same path.
Can a change be undone?
Usually with one tap. When a card is applied, PaidSync builds the inverse change at the same time and stores it on the card. Undo re-runs that inverse, and running it twice has no extra effect. Undo for a created campaign expires after 7 days. Some platform operations have no safe inverse, and the card says so instead of guessing. A card moves from pending to executing in one atomic step, so the same change cannot run twice.
Who can approve changes, and is it a single-user product?
Workspaces have four roles: viewer, editor, admin and owner. Viewers can only read. Editors and above can approve a card and can undo one, and the card records which user executed it. Only admins and the owner can set an agent to a band that executes on its own. It is not single-user, though there is no multi-step approval chain today; one approval from an editor or above executes the card.
How are our platform tokens and API keys stored?
You connect each ad platform yourself through that platform's OAuth screen. The resulting tokens are encrypted at rest with AES-256-GCM. If you bring your own model key, it is encrypted with AES-256-GCM under a separate key-encryption key. Each session is bound to one active account per platform, set explicitly, and a run cannot silently spend on another account. Disconnecting a platform deletes its tokens.
Is there an audit log, and can we export it?
Every live mutation is written to a change log with the user, the account, the tool, a summary of the arguments, the source and the actor. Dry runs are not logged because nothing changed. The log is readable in the product and through the get_operator_change_log tool, 100 rows per call, with a before-and-after outcome on each row. Automation run history keeps the most recent 50 entries, and the proposal board and brand audit log list the most recent 50 entries too. There is no CSV, SIEM or webhook export yet.
Which third parties process our data?
The ad platform APIs you connect: Google, Meta, LinkedIn, TikTok, Microsoft, Snapchat, Reddit, Pinterest, X and OpenAI Ads. Model providers: Anthropic, OpenAI, Google Gemini and Groq. Resend for email, Stripe for billing, Firebase and Firestore for authentication and data, Vercel and Google Cloud Run for hosting, Microsoft Clarity for website analytics, and Telegram for internal operations alerts only.
What happens when we delete our account?
You delete it yourself from Settings. The account is suspended and signed out immediately, marketing email stops the same day, and you have 30 days to change your mind by signing back in. After 30 days the account data, the connected platform tokens and the authentication record are hard-deleted and the subscription is cancelled. Billing and usage records are kept for 7 years with your identifiers stripped and replaced by an internal reference, to meet tax record-keeping rules. Self-serve data export is not built yet, so request a copy by email before deleting.
Are single sign-on and a data processing agreement available on request?
Yes, both are on request, and no independent audit report exists yet. We would rather say that plainly than tick a box we cannot back. Send your questionnaire to support@paidsync.ai and you will have written answers within two business days.