GravityAds exists because letting AI agents directly modify ad accounts is dangerous. Our entire architecture is designed around the principle: AI proposes, humans approve, systems audit.
Every platform write follows a strict lifecycle: draft → preflight validation → risk scoring → human approval → execution → observation → feedback capture. No agent can skip a step.
Platform credentials (OAuth tokens, developer tokens) are never stored in GravityAds databases. They're held as encrypted Secret Refs in cloud Secret Manager.
All API responses pass through three redaction layers before reaching any client — MCP or Portal.
Every operation — read or write — produces an immutable audit record with the original request, transformed output, and platform response.
GravityAds enforces scope checks at three levels: token scope (OIDC), plan entitlement, and control-plane role policy.
Designed for Cloud Run with minimal attack surface.
We're actively working toward SOC 2 Type II certification. Our architecture already implements the controls required for trust services criteria. Contact us for our current compliance documentation.
We're happy to walk through our security architecture with your team.