Your data security is our top priority. Learn about the measures we take to protect your information and maintain compliance with global standards.
Annual audits verify our security controls meet the highest standards for data protection and availability.
Full compliance with the EU General Data Protection Regulation. Data subject rights fully supported.
California Consumer Privacy Act compliance with full transparency and consumer rights support.
Information security management system certified to international standards.
| Standard | Status | Target / Audit cycle |
|---|---|---|
| GDPR | Compliant | Ongoing — self-attested; reviewed quarterly |
| CCPA | Compliant | Ongoing — self-attested; reviewed quarterly |
| SOC 2 Type II | In progress | Audit completion target Q3 2026 |
| ISO 27001 | In progress | Stage 2 audit target Q4 2026 |
| HIPAA | Not applicable | We do not process PHI by design |
| PCI-DSS | Not applicable | Card data handled exclusively by Stripe (PCI Level 1) |
Status reviewed monthly. For procurement teams: detailed scope, current Letter of Engagement with our auditor, and SOC 2 readiness gap analysis available under NDA — request from [email protected].
Specifics on testing, where your data lives, who else touches it, and how to report a vulnerability.
Last test: Q1 2026 by a CREST-certified independent firm. Scope: public API, dashboard, beacon ingestion, billing surface.
Findings: 0 critical, 0 high, 2 medium (both remediated within 30 days). 4 informational items addressed in the same release window.
The authoritative, current sub-processor list (Hetzner/AWS, Stripe, Postmark, Sentry, Cloudflare) — with purpose, data accessed, and region for each — is maintained in one place to prevent drift.
View sub-processor list →Security researchers are welcome. We commit to acknowledging reports within 48 hours, no legal action for good-faith research within scope, and recognition in our hall of fame.
We implement multiple layers of security to ensure your data is protected at every level.
MyClickShield integrates with the Google, Meta and Microsoft advertising APIs solely to provide click fraud protection to the authenticated advertiser. We never sell or share API data with third parties.
OAuth scope: https://www.googleapis.com/auth/adwords
Purpose: Detect invalid clicks and help advertisers reduce wasted ad spend.
Services called:
CustomerService.listAccessibleCustomers — list authorized Google Ads accounts during OAuth setup.GoogleAdsService.searchStream — read ENABLED campaigns so we know where to apply IP exclusions.CampaignCriterionService.mutate — add / remove negative IP_BLOCK criteria on campaigns. Every mutation is reversible from the dashboard.ConversionAdjustmentUploadService.uploadConversionAdjustments — upload RETRACTION adjustments for flagged clicks (opt-in).User control: Every automated action is configurable, reversible, and auditable from the MyClickShield dashboard. The user may revoke OAuth consent at any time. We do not read or modify ad content, budgets, billing, targeting, or keywords.
Permissions: ads_management, ads_read, business_management
Purpose: Filter invalid traffic from Facebook and Instagram advertising campaigns.
Services used:
User control: The user can review every exclusion and disable automated actions at any time from the MyClickShield dashboard.
OAuth scope: https://ads.microsoft.com/msads.manage
Purpose: Protect Microsoft Ads campaigns from invalid traffic.
Services used:
User control: All changes are logged, reversible, and disabled by default until the user explicitly opts in.
All data is encrypted in transit (TLS 1.3) and at rest (AES-256). OAuth refresh tokens and API credentials are stored in an encrypted secrets store and never exposed in logs or error messages.
Customer data is stored in isolated database tables with strict row-level access controls. Production databases are backed up daily and backups are encrypted with separate keys.
Click-level data is retained for the duration of the subscription plus a grace period of 30 days. Aggregated, non-identifiable statistics may be retained for longer for product analytics.
Account deletion requests are processed within 30 days. Upon deletion, OAuth tokens are revoked, personal data is removed, and API connections to advertising platforms are terminated.
Multi-cloud infrastructure with automatic failover and geographic redundancy across US and EU regions.
300+ edge locations via Cloudflare for low-latency fraud detection worldwide.
Choose where your data is stored. EU-only processing available for European customers.
Our security team is available to answer your questions and provide additional documentation for your compliance requirements.