Row Level Security by default
Customer-facing reads are protected by Supabase RLS policies. Users only see rows linked to organizations they belong to.
Security at AdTool
Designed around least privilege, explicit approval and auditability.
AdTool separates the public website, customer portal, Supabase data layer and Google Cloud worker so sensitive credentials and campaign-changing operations stay off the browser.
Privileged work stays server-side
Service role access is only used inside Supabase Edge Functions and the Cloud Run worker, never in the static browser bundle.
Google Ads changes require approval
AI can propose actions, but Google Ads mutations are only dispatched after an authenticated user approves them.
Worker isolation
Google Ads and OpenRouter jobs run in Google Cloud Run behind a shared worker secret, with operational logs and job records.
Audit trails
Syncs, audits, proposed actions, approvals, worker jobs and mutation results are recorded in Supabase tables.
No password sharing
Customers never share Google passwords. Access is delegated through the Google Ads manager-account workflow.
How access works
The browser uses Supabase Auth and RLS for customer-visible data. Supabase Edge Functions validate user intent and dispatch jobs. Google Cloud Run performs Google Ads and AI work with secrets stored server-side. Every approved mutation is logged before and after execution.