Security

• Encryption in transit. Traffic to and from the platform is served over HTTPS/TLS.
• Passwords. Stored only as salted one-way hashes — never in readable form, and never returned to the browser.
• Connected ad-platform credentials. Encrypted with AES-256-GCM using a key held separately from the data, and decrypted only for the duration of a sync request.
• Data minimization. We collect only what we need, and your content and customer data are not sold or used to train AI models. See our Privacy Policy.

• Access to production systems is limited to the people who need it to operate the Service.
• Session tokens are stored only as hashes; the raw token lives solely in your browser cookie, which is marked httpOnly and secure in production.
• We recommend you use a strong, unique password for your account.

We rely on established sub-processors that maintain their own security programs — for AI processing, payments, hosting, and email. The current list is maintained in Annex III of our Data Processing Agreement. We share with them only what is needed to deliver the Service.

We do not currently hold a SOC 2 or comparable third-party certification. Formal certification is on our roadmap as we grow. In the meantime we are happy to discuss our security practices with prospective customers — contact us at info@extendmarketing.ai.

If you believe you have found a security vulnerability, please report it responsibly to info@extendmarketing.ai. Please give us a reasonable chance to investigate and fix the issue before any public disclosure. We will not pursue legal action for good-faith research that respects user privacy and does not disrupt the Service.