Security is central to a product that operates real advertising budgets on your behalf. This page summarizes the measures Inbox uses to protect your data and connected accounts.
1. Authentication and access
- Passwords are hashed; we never store them in clear text.
- Optional Google sign-in through OAuth.
- Role-based access control within each workspace (owner, admin, member).
- Scoped API keys for programmatic and MCP access, revocable at any time.
2. Protecting connected ad accounts
- Platforms are connected through OAuth; we do not receive or store your platform passwords.
- You can revoke any connection at any time from Connections or from the platform's own settings.
- Human-in-the-loop approval: actions that can start ad spend require explicit approval before they run.
- Read operations are separated from write operations, and write access is permission-gated.
3. Data protection
- Encryption in transit using TLS.
- Managed, access-controlled database and object storage.
- Least-privilege access to production systems.
4. Auditing and monitoring
- Every tool call and write action is logged with actor, action, result and timestamp.
- Audit logs are available to workspace administrators.
- We monitor for abuse and rate-limit sensitive operations.
5. AI safety
- AI assistants operate only within your connected accounts and only on your instruction.
- Spend-starting actions are never executed by AI without human approval.
- Your data is not used to train third-party AI models.
6. Responsible disclosure
If you believe you have found a security vulnerability, please report it to [email protected]. We appreciate responsible disclosure and will work with you to resolve valid issues promptly.