01Meta tokens
- LiveAds reaches Meta only through Facebook Login for Business. We do not hold, and never ask for, Facebook passwords, cookies or browser sessions.
- A token is encrypted inside the application with AES-256-GCM before it reaches the database. The key lives in the server environment, apart from the database and its backups.
- Tokens stay on the server and are never sent to a browser. Every Graph API call is signed with
appsecret_proof; the app secret stays on the server as well. - On disconnect LiveAds revokes its permissions with Meta and erases the token.
02In transit
Traffic to liveads.app and to Meta’s APIs travels over HTTPS only (TLS 1.2 or newer). The session cookie is HttpOnly, Secure and SameSite=Lax. Fonts and site files are served by our own server, with no third-party CDN.
03Workspace isolation
Every record belongs to a workspace and every query is limited to the workspace of the signed-in person. Data of different advertisers never mixes. Inside a workspace, the server checks access in every section: a member sees only the profiles, ad accounts and Pages granted to them.
04Logs
- Each call to Meta’s APIs is recorded with time, endpoint, outcome and rate-limit headers - never with the token.
- Each action taken for you - launches, statuses and budgets, rule runs, moderation, connections and deletions - goes into the workspace audit log.
05Our own access
Production systems are open only to the people who run LiveAds, only when needed, and access is logged. We look inside a workspace only to answer your support request or to investigate an incident.
06Backups
Backups are encrypted and rotated: copies older than 30 days are destroyed. A deletion reaches backups as they expire, within the same 30 days. See Data deletion.
07Incidents
If an incident touches your data, we contain and fix it straight away, tell the owners of affected workspaces without undue delay, and, where Meta Platform Data is involved, report it to Meta through its incident channel as soon as practicable. We notify regulators where the law requires it.
08Report a vulnerability
Found a vulnerability? Email [email protected] with steps to reproduce. We acknowledge within 3 business days and keep you posted until it is fixed. Do not touch data that is not yours, do not degrade the service and do not publish details before the fix. We will not pursue good-faith research that follows these rules.
Machine-readable contact: /.well-known/security.txt.