Security

Read-only by design — and by proof

Every platform connection ROASTED uses is scoped to reading performance data. It cannot post, spend, pause campaigns, change budgets, or manage people on your accounts.

We don’t just claim that — we test it. Against our own Meta System User token we ran eleven distinct write attempts: editing a campaign, renaming an ad account, removing a Business Manager member, creating ad accounts, claiming assets, creating pixels. All eleven were rejected by Meta. We repeat this class of test whenever a token or permission setup changes.

What a stolen token could do

The honest threat model: if a ROASTED platform token ever leaked, the attacker could read reporting numbers. That’s the entire blast radius — no campaign control, no billing access, no member management. We designed for the worst day, not the best one.

Recommended setup on your side

• Meta: connect via a System User with Employee access and assets assigned as View performance only. Our tutorial walks through it in four steps.
• TikTok: use a token from an app with reporting scopes; ROASTED needs nothing beyond reporting and account listing.
• Google Analytics: a service account with Viewer access to the property.

Application security

• Passwords are hashed (never stored or logged in plain text); sessions use HttpOnly, Secure, SameSite cookies.
• Sign-in is rate-limited per email and IP address.
• All traffic is HTTPS; HTTP requests are redirected.
• API documentation endpoints are disabled in production.
• Databases live outside the web root and are backed up daily with integrity checks; backups are encrypted at rest.

Data we store

Connection credentials you provide, and the performance numbers needed to build your reports — spend, impressions, clicks, per-ad daily metrics, and creative thumbnails. Report PDFs are cleaned up automatically. We store no card data of any kind.

Questions

Security questions get priority answers — write to us via the Contact page and mention “security” in the subject.