Security at MyAdMaker

• The application runs on managed container infrastructure (Railway) with health checks and automated restarts; the database is a managed EU-region service (Turso).
• Assets, exports and published campaigns are stored and delivered via Cloudflare R2 with bucket-level separation between private workspace assets and public published content.
• Build artifacts are kept out of public delivery paths; published campaigns receive only the files they need.
• Background work (export bundling) runs in an isolated worker with a Redis queue; jobs carry references, not credentials.

• All connections — app, API, asset delivery, webhooks — are TLS-encrypted in transit.
• Data at rest is encrypted by our storage providers (database and object storage).
• Password-gate tokens for protected ad links are HMAC-signed server-side; gate passwords are stored only as hashes.
• Payment credentials never touch our servers — they flow directly to Stripe, a PCI-DSS Level 1 provider.
• Webhooks from auth and billing providers are signature-verified (Svix / Stripe signatures) before processing.

• Customer authentication is handled by Clerk, supporting multi-factor authentication and modern session management; we never see or store your password.
• Authorization is workspace-scoped: every project, asset and export request is checked against workspace membership; admin capabilities are role-gated separately.
• Production access within Scalista follows least privilege — per-service scoped credentials, no shared accounts, and access limited to personnel who operate the system.
• Published-campaign visibility settings (public, unlisted, password-gated) are enforced server-side on every request.

• Changes ship through version control with review; type-checked codebase end to end.
• All user input — uploads, configs, AI outputs applied to projects — is validated against strict schemas before persistence; AI-generated config patches pass an additional validation pipeline before they touch a project.
• Dependencies are monitored and updated; secrets live in environment scopes, never in the repository.
• Uploaded media is type- and size-validated, then re-processed (optimized) before serving — originals are not served raw.

• Exported playables are self-contained bundles: no third-party scripts, no trackers, no network calls beyond the hosting ad network's own SDK hooks.
• Playables set no cookies; their only browser storage is a sound-preference key. Gameplay events stay inside the hosting network's sandbox.
• Preview embeds are frame-restricted (SAMEORIGIN / CSP frame-ancestors) so your unreleased work can't be embedded elsewhere.
• Export compliance checks enforce network size caps and packaging rules before a bundle leaves the system.

• Errors and performance are monitored with Sentry — stack traces and request context only, no screen capture.
• Product session replays (PostHog, EU-hosted) exist only for users who opted into Analytics: keyboard input and sensitive elements are masked client-side before upload, and replay access is limited to the product team.
• Server logs are retained up to 90 days for security analysis, then dropped.
• Suspected incidents are triaged immediately; confirmed personal-data breaches are notified to affected customers and authorities without undue delay per Art. 33/34 GDPR.
• Post-incident reviews feed back into hardening — every incident ends with a fix, not a memo.

Deletion requests propagate to backups within the provider-defined backup rotation windows after the primary deletion.

Found a vulnerability? We want to hear it from you first. Email [email protected] with subject SECURITY and reasonable detail to reproduce.

• We acknowledge within 72 hours and keep you informed through the fix.
• Good-faith research conducted without data exfiltration, service disruption or privacy violations will not be met with legal action — safe harbor.
• Please give us reasonable time to remediate before public disclosure; we credit researchers who want it.

Out of scope: volumetric attacks, social engineering of staff or customers, and findings on third-party services we don't operate (report those to the respective vendor).