Marketing Platform Security: Encryption, CSP & Audit Logs
Your ad accounts, store data and billing run through this platform - so security is engineered in at every layer, and documented openly at /trust.
A marketing platform holds an unusual concentration of power: access to your ad accounts, your store's orders and revenue, your customer conversations and your payment flows. That makes its security posture a first-order buying question, not a footnote. BScale AI is built with defense in depth, and the full picture is published openly on the trust page.
The short version: you authenticate platforms through OAuth so BScale AI never holds your passwords, every stored token is encrypted with AES-256-GCM, sessions are cookie-based with CSRF protection, every page ships a per-request Content Security Policy, APIs are rate limited, and account activity is recorded in an append-only audit log that nobody - including administrators - can quietly edit.
Encrypted credentials and OAuth token protection
BScale AI never asks for the password to your Meta, Google, TikTok or LinkedIn accounts. Connections use each platform's official OAuth flow: you log in on the platform's own pages, grant scoped permissions and can revoke them at any time from either side.
The access tokens those platforms issue are the crown jewels of any marketing tool, so they are encrypted with AES-256-GCM before being stored. Even in the event of unauthorized database access, tokens are not sitting in plaintext waiting to be harvested.
Session security: cookies, CSRF and per-request CSP
User sessions are cookie-based and protected against cross-site request forgery, so a malicious website you happen to visit cannot silently issue requests to BScale AI on your behalf. This is a classic attack against marketing tools, where a forged request could launch spend or alter campaigns, and it is blocked at the platform boundary.
Every page is also served with a per-request Content Security Policy. Instead of one static policy, each response carries its own nonce-based CSP, which sharply limits what injected scripts could do even if malicious content ever reached a page. It is one of the stronger browser-side protections a web application can deploy.
Rate limiting and an append-only audit log
All APIs are rate limited, with stricter budgets on sensitive operations. Rate limiting blunts brute-force attempts, abuse of AI endpoints and runaway automation alike, keeping the platform stable for everyone.
Account activity is written to an append-only audit log: entries can be added but the application has no path to update or delete them. When you need to know who did what and when - a compliance review, an incident investigation, or a simple accountability question inside your team - the log is a record that cannot have been quietly rewritten.
Security that extends to roles, billing and approvals
Security is not only cryptography; it is also who can do what. Workspace sharing uses role-based access control enforced on the server for every request, so a viewer can never act with a manager's power. Billing runs through PayPal with an itemized ledger, so money movements are inspectable. And nothing publishes to your ad accounts without your explicit approval, which keeps the human in control of the actions that matter most.
The complete, current security posture - including practices we adopt as the platform evolves - is documented on the public trust page. If your organization has a security questionnaire, that is the place to start.
Frequently asked questions
- How does BScale AI store my ad account credentials?
- It never stores your passwords at all. Platforms are connected through their official OAuth flows, and the access tokens they issue are encrypted with AES-256-GCM before storage. You can revoke a connection at any time from BScale AI or from the platform's own security settings.
- What is an append-only audit log and why does it matter?
- It is an activity record that the application can add to but never update or delete. That means the history of who did what in your account cannot be quietly rewritten, which is essential for incident investigations, compliance reviews and plain accountability inside a team.
- How does BScale AI prevent cross-site request forgery (CSRF)?
- Sessions are cookie-based and every state-changing request is protected with CSRF checks, so a malicious third-party website cannot trick your browser into issuing requests to BScale AI on your behalf - such as altering campaigns or spending budget.
- What is a per-request Content Security Policy?
- Instead of one static browser security policy, BScale AI generates a fresh nonce-based Content Security Policy for every single page response. This sharply restricts what any injected script could execute, providing strong protection against cross-site scripting attacks.
- Can BScale AI's AI take actions on my accounts without me?
- No. The AI prepares campaigns, creative and recommendations, but nothing goes live on Meta, Google Ads, TikTok or LinkedIn without your explicit approval. Combined with server-enforced role-based access control, humans stay in control of every consequential action.
- Where can I read BScale AI's full security details?
- The public trust page documents the platform's security posture, including OAuth-based connections, AES-256-GCM token encryption, CSRF protection, per-request CSP, rate limiting and the append-only audit log. It is the right starting point for any security review.