01Meta tokens
- ads.cab reaches Meta only through Facebook Login for Business. We do not hold, and never ask for, Facebook passwords, cookies or browser sessions.
- A token is encrypted inside the application with AES-256-GCM before it reaches the database. The key lives in the server environment, apart from the database and its backups.
- Tokens stay on the server and are never sent to a browser. Every Graph API call is signed with
appsecret_proof; the app secret stays on the server as well. - On disconnect ads.cab revokes its permissions with Meta and erases the token.
02In transit
Traffic to ads.cab and to Meta’s APIs travels over HTTPS only (TLS 1.2 or newer). The session cookie deck_session is HttpOnly, Secure and SameSite=Lax. Fonts, styles and scripts are served by our own server; there is no third-party CDN and no inline script, and the CSP header enforces that.
03Cab isolation
Every record belongs to a cab and every query is limited to the cab of the signed-in person. Data of different advertisers never mixes. Inside a cab, the server checks access in every section: a member sees only the profiles, ad accounts and Pages granted to them.
04Logs
- Each call to Meta’s APIs is recorded with time, endpoint, outcome and rate-limit headers, never with the token.
- Each action taken for you, launches, statuses and budgets, Watch rule runs, Comms moderation, connections and deletions, goes into the cab audit log.
05Our own access
Production systems are open only to the people who run ads.cab, only when needed, and access is logged. We look inside a cab only to answer your support request or to investigate an incident.
06Backups
Backups are encrypted and rotated: copies older than 30 days are destroyed. A deletion reaches backups as they expire, within the same 30 days. See Data deletion.
07Incidents
If an incident touches your data, we contain and fix it straight away, tell the owners of affected cabs without undue delay, and, where Meta Platform Data is involved, report it to Meta through its incident channel as soon as practicable. We notify regulators where the law requires it.
08Report a vulnerability
Found a vulnerability? Email [email protected] with steps to reproduce. We acknowledge within 3 business days and keep you posted until it is fixed. Do not touch data that is not yours, do not degrade the service and do not publish details before the fix. We will not pursue good-faith research that follows these rules.
Machine-readable contact: /.well-known/security.txt.