Security
You connect the account. The audit can only read it.
The permission Google issues is capable of writing - there is no version of it limited to reading. The audit's code is not: it makes two read calls to the Google Ads API and contains no method that could change, pause or spend anything.
Below is exactly what it reads, where that data sits, and how to cut it off in one click.
Get my free auditNo card. Revoke whenever you like. No Google login handy? The free 30-second scan reads only your public homepage and needs no account at all.
The only direction that exists in the audit's code
2
read operations the audit can call
0
write operations in the audit
EU
region the database sits in
1 click
to cut our access off
Three parts, because the answer is not the same for each:
- 1. The audit. For the audit, our software only reads the account.
- 2. AI Autopilot. After your agreement for an account, it prepares the changes it would make. You apply the ones you choose.
- 3. The managed service. The team changes things in your account, on purpose.
Part 1 - The audit
For the audit, our software only reads the account.
Two operations. That is the entire surface.
The audit's code reaches the Google Ads API through one file. It exposes a read query and a list of your accounts. Nothing else exists for it to call.
It can
- Run read queries against your account in GAQL, Google's query language
- List which Google Ads accounts your Google login can reach, so you can pick one
Named in the code as query() and
listAccessibleCustomers().
It can never
- Change a campaign, a budget, a bid, a keyword or an ad
- Pause, enable or delete anything
- Spend a cent of your budget
- Upload conversions, customer lists or any other data into your account
- Add a user, a manager or another account link to yours
Not because we promise to behave. Because no mutation method - create, edit, delete, upload - is imported anywhere in the audit's code. Adding one would be a deliberate code change and a code review, never a runtime accident.
Part 1 - The audit: what it reads
Exactly which fields it reads.
The 22 checks need structure and performance. They need nothing about you, with one exception: the change history gives the email address of each person who changed the account.
It reads
- The list of Google Ads accounts your Google login can reach, with each one's id, name, currency, time zone and manager and test flags. We keep this list, including the accounts you do not pick, so that you can switch between them.
- Account settings: descriptive name, currency, time zone, auto-tagging and conversion tracking status
- Campaigns: name, status, type, bidding strategy, networks, geo targeting, budget and the budget Google recommends, optimization score, the reasons Google gives for a campaign's status, performance and impression share
- Ad groups: name, status, ad rotation, performance
- Keywords: text, match type, status, Quality Score and its three parts, performance
- Search terms: the 500 that cost the most over the last 30 days, and, for the dashboard, the keywords and paid search terms that brought conversions over the last 90 days
- Conversion actions: name, type, category, source, counting, default value, windows, attribution model, and the date of the last conversion
- Ads: type, status, ad strength, approval status, clicks and impressions. Not their text.
- Audiences: name, type and size
- Breakdowns by hour and day of the week, by device and by network; the delay between click and conversion over the last 60 days; the trend over 90 days; monthly totals over 12 months; conversions by action
- The change history of the last 28 days, up to 500 changes, including the email address of the person who made each change
- Google's recommendations for the account (their type, whether they were dismissed, and their expected effect), and the account's optimization score
- Negative keywords: how many there are, not their text
- For the dashboard: Shopping and Performance Max products (id and title), the domains of competitors in the same auctions, and figures by campaign
It never reads
- Your Google Ads billing or payment information
- Any personal data beyond what the Google Ads API itself exposes
- Anything in your Gmail, Drive, Calendar or any other Google product. The only thing we keep from outside Google Ads is the name and email on your Google profile, which is what creates your DigiWise account - the two userinfo scopes below, and nothing more
How far back: most checks read the last 30 days. A few read up to 90 days for conversion-lag and trend checks, and the dashboard trend charts read up to 12 months of monthly totals.
The consent screen
Google will warn you it can edit. Read that carefully.
Google publishes exactly one Google Ads scope and it covers reading and writing. There is no variant limited to reading, so nobody can offer you one. The limit is in our software, not in the permission you grant - and that is the only honest way to put it.
-
https://www.googleapis.com/auth/adwordsRead your Google Ads account through the Google Ads API: for the audit, and for AI Autopilot on an account where you agreed to it. This is the only Ads scope Google publishes - there is no version of it limited to reading.
-
https://www.googleapis.com/auth/userinfo.emailCreate your DigiWise account from your verified Google email.
-
https://www.googleapis.com/auth/userinfo.profileYour name, on your DigiWise account. Google also sends your picture; we do not keep it.
-
openidRequired by Google's OAuth implementation.
Returning later usually asks you for nothing: we only send you back through the full consent screen when we do not already hold a token for you.
Part 2 - AI Autopilot
It prepares. You apply.
After your agreement for an account, AI Autopilot reads it and prepares the changes it would make on your Search campaigns, each with its reason. You apply the changes you choose, in your Google Ads account. Automatic changes are not open yet: we will tell you before they open, and they will need a new agreement from you.
- It reads nothing until you agree, in the window that opens when you click Prepare this account. We record that agreement, with the versions of our privacy policy and terms it showed.
- It uses your own Google connection and the same permission as the audit. Nothing it prepares reaches your account unless a person applies it there by hand: you, or the team on a managed plan.
- To prepare real changes, it reads more than the audit: your bids and targets, the text of your Search ads and assets, your negative keywords, your ad schedules, and 29 days of change history - without the email addresses of who made each change. The full list is in the privacy policy, section 3.
- Claude, the AI model by Anthropic, receives part of it to sort search terms and write ad texts. Never your Google token, your account number, Google's internal ids or the email addresses of the people who edit your account.
- For the first 30 days after your agreement, a person at DigiWise reads what it reads and prepares for that account, to check its work. On a managed plan, the team reads it for as long as your plan and your agreement last.
- The stop button on the AI Autopilot page, then one confirmation, stops it for that account and deletes what it holds there. Disconnecting Google stops it too.
On a managed plan it is included, and it still waits for your own agreement. Part 3 says what the team does with it. The detail, with what we keep and for how long, is in the privacy policy, section 3c.
Part 3 - The managed service
Here, we do change things. On purpose.
A managed plan is a different arrangement, and it should not be blurred into the one above.
You invite DigiWise as a manager on your Google Ads account. The team then changes campaigns, budgets, bids, keywords, negatives, ads and targeting - that is the work you are buying.
- DigiWise AI reads the account, ranks what it finds, with what each problem costs where it can be measured, and surfaces it. It never applies anything. A person decides and applies.
- AI Autopilot is included. It reads the account only after your own agreement. It prepares; the team decides and applies, by hand, in your Google Ads account.
- Google Ads keeps its own change history on your account, under your control, showing every change and who made it. You do not have to take our word for the list.
- Every change also lands in your monthly report, with what it did to the money.
- Manager access is granted by you and removed by you, in your own account, without asking us.
How the service runs, in full: the managed page.
July report
What changed, and what it did
- Stopped 47 searches They had spent for 90 days without a sale Saved -$1,247/mo
- Repaired the call-tracking tag It had been silent since April Fixed sales now counted
- Separated brand search from Performance Max No more paying twice for your own name Saved -$640/mo
- Raised the budget of a capped campaign It ran out of budget by 11:00 AM Raised +$1,400/mo
- New ad copy in test Against the two best performers Testing result next month
Illustrative figures on a sample account. Your report shows your own account, and every line is a change we actually made that month.
Leaving
Three ways to cut us off. None of them need us.
Revoking is one click, and two of the three routes happen entirely on Google's side, where we cannot be in the way even if we wanted to be.
From your DigiWise dashboard
Go to your dashboard's Settings and click Disconnect next to the connected account. We call Google's token revocation endpoint straight away, then mark the link revoked on our side so it disappears from your dashboard.
Being exact: if that call to Google fails we still mark it revoked, so our software stops using it either way - but the token itself would survive at Google. If that matters to you, use the second route as well. It is the one that cannot fail quietly.
From your Google account, without telling us
Open the permissions page on your Google account, find DigiWise, and choose Remove access. The token dies at Google, which means it dies everywhere.
On a managed plan, from Google Ads itself
Remove DigiWise under "Access and security" in your own Google Ads account. It takes effect immediately on Google's side. You do not have to ask us, and cancelling the subscription is a separate step in your billing page.
Deleting your DigiWise account goes further: it revokes every token we hold with Google and removes your account's rows from our database, AI Autopilot's included. It works once no paid subscription renews on your account: stop yours first, in Stripe, because deleting the account does not stop the billing. The privacy policy lists the few records it does not cover. Ask by email and we process it within 7 days. The first two routes above also stop AI Autopilot. The third does not: AI Autopilot reads through your own Google connection, not through our manager access. To stop it alone on one account and keep the audit, use the stop button on its page.
Get my free auditStorage and transport
Where the data sits, and what protects it.
The one secret worth stealing here is your Google refresh token. This is the shape of the row it is written into.
One row in the database
12-byte IV
Fresh random bytes, every single write.
your refresh token, encrypted
AES-256-GCM. Unreadable without the key, which is not in this row or in this database.
16-byte tag
A tampered value fails to decrypt instead of decrypting to something else.
The 32-byte key is the part deliberately missing from the picture: it lives in our server environment only. Never in source control, never in your browser, never in a page we send you. The row sits in Supabase in the EU (eu-west).
The token
- Your Google refresh token is encrypted with AES-256-GCM before it is written to the database - a fresh 12-byte random IV each time, and a 16-byte authentication tag, so a tampered value fails to decrypt rather than decrypting to something else.
- The 32-byte key lives in our server environment only. Never in source control, never in your browser, never in a page we send you.
- The database is Supabase in the EU (eu-west). The site itself runs on Vercel, pinned to one region, dub1 (Dublin).
- Card numbers never reach us at any point. They go from your browser to Stripe.
- Every inbound webhook is signature-checked before we read it: Stripe with its own scheme, Calendly with an HMAC over the exact bytes received, Resend with the Svix scheme. Unsigned or stale requests never reach the database.
Sent with every response on this site
-
Content-Security-Policy
default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requeststhe opening of a longer policy - the rest is a named allow-list of the scripts, frames and connections we permit, one entry per processor listed further down, plus form-action locked to this site and Stripe checkout
-
Strict-Transport-Security
max-age=63072000; includeSubDomains; preloadHTTPS only, for two years, preloaded
-
X-Frame-Options
DENYthis site cannot be framed by anyone
-
X-Content-Type-Options
nosniff -
Referrer-Policy
strict-origin-when-cross-origin -
Permissions-Policy
camera=(), microphone=(), geolocation=(), interest-cohort=()nothing on this site may ask for any of them
Who else touches it
Nine companies, and what each one gets.
We do not sell your data. These are the processors behind the product, each getting only what it needs to do its job.
- Supabase
- Database, EU region (eu-west)
-
Gets: everything the privacy policy describes as stored: your account, your connected Google Ads accounts, your audits and the dashboard's copy of your account data, everything AI Autopilot keeps, and our prospect records (the privacy policy, section 2b). This is where our data lives.
Where: European Union (eu-west region).
- Vercel
- Hosting
-
Gets: every request to this site and every page we send back pass through Vercel, so it sees request metadata such as your IP address, and the pages you open, which can show your Google Ads data.
Where: our server code runs in one region, dub1 (Dublin, Ireland); a request can enter Vercel's network at a point near you, which can be outside the European Union. Vercel is a United States company.
- Sign-in (OAuth) and the Google Ads API
-
Gets: Your Google account identity, and the Google Ads account you choose to connect - covered in detail in the privacy policy, section 3.
Where: Google's own network, worldwide.
- Anthropic
- Claude, the AI model that writes the audit summary, the dashboard summary and the free-scan insight, and that AI Autopilot uses to sort search terms and write ad texts
-
Gets: from an audit, the account's name, its totals for the period and the findings, including the campaign, ad group, keyword and search-term text each finding is about; from the dashboard, the account's name, its figures, amounts by campaign, paused campaigns, trends, a conversion action that stopped recording and the titles of the top findings, with search terms masked; from the free scan, the domain you typed, the industry we inferred, a short sample of the page title and description, and which tracking tags were found; from AI Autopilot, only for an account where you agreed to it, the data listed in the privacy policy, section 5. Never your email address, your name, your Google token, your billing details, your Google Ads account number or the email addresses of the people who edit your account.
Where: United States. Anthropic stores what it receives there, and the model can run in other regions.
- Stripe
- Payments
-
Gets: your name, email and billing details, and, for a plan tied to a Google Ads account, that account's id, so that the payment is linked to the right account. Card numbers go straight from your browser to Stripe. We never see them and never store them.
Where: Stripe Payments Europe (Ireland), which can transfer data to Stripe in the United States.
- Resend
- Email sending, and the delivery events it sends back
-
Gets: your email address and the content of the messages we send you. Some carry data from your Google Ads account: the monthly email of the former Audit Plus plan gives the account's name, its score, the measured 30-day spend on searches with no recorded sale and the titles of the top findings; the managed plan's emails give the account's id; our own alerts about a failed scheduled read give the account's id and the client's email address. Resend then tells us whether each message was delivered, bounced, marked as spam or failed. Open and click tracking is turned off: we do not know whether you opened a message or which link you clicked.
Where: United States.
- Calendly
- Booking the strategy call
-
Gets: Your name, email, the time you picked, your answers to the booking questions, and any campaign parameters the booking link carried.
Where: United States.
- Intercom
- Support chat
-
Gets: Whatever you type into the chat. If you are signed in, we also pass your DigiWise user id and your email address, so we know who is writing. Nothing from your Google Ads account is passed to it: not the account id, not its name, not its spend. The chat does not load on pages whose address names a Google Ads account or an audit, on shared reports, or on the audit and AI Autopilot pages; there, the support button opens an email instead. Before October 29, 2026, it was sent some Google Ads data: see "Before October 29, 2026" in the privacy policy, section 5.
Where: United States (our workspace is hosted there).
- PostHog
- Product analytics, EU region
-
Gets: Page views and clicks on this site, and never your Google Ads data: account ids, audit ids and share links are removed from every address and event before it leaves your browser, and inside the dashboard the text and links of what you click are masked. PostHog loads only after you accept analytics. Once you accept analytics it also records your visits to our public pages (screen replay); signed-in pages are never recorded. See the cookie policy. Before October 29, 2026, it received some Google Ads account ids: see "Before October 29, 2026" in the privacy policy, section 5.
Where: European Union (Frankfurt).
Advertising and analytics tags - Google Analytics, the Meta Pixel and the Google Ads tag - are not on this list. None of them receives data from your Google Ads account, and they load only with your consent, on our public marketing pages only. Before October 29, 2026, Google Analytics could receive Google Ads account ids from our dashboard pages, after you accepted analytics: the privacy policy, section 5, says more. Their own list is in the cookie policy. Some of the companies above keep data in the United States: the privacy policy, section 5, says which, and how those transfers are protected.
The long version, including retention and your GDPR rights, is in the privacy policy.
Questions
The questions people actually send us.
Can the audit software change anything in my account?
No. It calls two operations against the Google Ads API:
- A read query.
- A list of the accounts your login can reach.
No create, edit, delete or upload method is imported anywhere in the audit's code, so there is nothing at runtime that could write even by accident. Changing that would take a deliberate code change and a code review.
Then why does Google warn me about editing permissions?
Because the permission is genuinely capable of it. Google publishes one Ads scope, adwords, and it covers reading and writing - there is no variant limited to reading.
Anyone telling you an app can get API access to Google Ads that is limited to reading is describing something that does not exist.
The limit here is our software, not the permission you grant, and that distinction is the honest way to state it.
What is different on a managed plan?
On a managed plan you invite DigiWise as a manager on your Google Ads account, which is a different permission from the OAuth connection above.
- A person at DigiWise does change things - campaigns, budgets, bids, keywords, negatives, ads, targeting. That is what the managed plan pays for: $997/mo per account, up to $10,000/mo of ad spend.
- AI Autopilot is included. It reads the account only after your own agreement; it prepares, and the team decides and applies.
- Google Ads keeps its own change history on your account, showing every change and who made it.
- Every change also appears in your monthly report.
Do you hold SOC 2 or ISO 27001?
No. We hold no security certification and we have not commissioned an external audit, and we would rather write that plainly than leave a gap that reads like a yes.
What we can show is on this page:
- Which two API calls the audit makes.
- How the token is encrypted.
- Where the data sits.
- How to cut us off in one click.
If a certificate is a hard requirement on your side, tell us before you connect anything.
Who at DigiWise can see my data?
The internal screens that show customer records are gated on an explicit allow-list of administrator email addresses - not a role flag anyone can be granted by mistake.
On a managed plan, Attilio and the team he leads also work in your Google Ads account directly, with the manager access you granted. For AI Autopilot, your agreement for an account lets a person at DigiWise read what it reads and prepares there, to check its work, for the first 30 days; on a managed plan, the team reads it for as long as your plan and your agreement last.
Do you train AI on my account data?
No. We do not use Google API data to train, fine-tune or develop any model, ours or anyone else's.
Each call to Anthropic sends the data listed above and gets text back. Anthropic states that it does not use it to train its models, and that it deletes it within 30 days, unless its automated systems flag a call as a possible breach of its usage policy, in which case it may keep it for up to 2 years.
We also never sell or share Google API data for advertising.
I do not want to connect anything yet.
Then do not. The free scan takes a domain, fetches that site's public homepage and looks at the HTML for tracking tags. It touches no Google account and needs no sign-in at all.
Two things it does do, so you are not surprised:
- The domain, what we found and the industry we inferred go to Anthropic, to write the personalised paragraph you read.
- We keep a record of the scan keyed to the domain, even if you never give us an email.
Write to us with the domain and we delete that record - no account needed, nothing to prove.
How do I get my data out, or deleted?
- Instant JSON export from your dashboard: your profile, audits, purchases, connected accounts and AI Autopilot data, with OAuth tokens redacted.
- Deleting your account revokes every token with Google and removes your account's rows from our database, AI Autopilot's included. It works once no paid subscription renews on your account: stop yours first, in Stripe. The privacy policy lists the few records it does not cover.
- By email, we process deletion requests within 7 days.
We keep our accounting records, payment records included, for 7 years, as Belgian law requires - that is a legal obligation, not a choice.
Now you know what it can do.
Two read calls for the audit, an encrypted token in the EU, and one click to end it. The full audit is free: every leak and the fix for each one.
Get my free auditNo credit card at any point. The full report is included.
Still not ready to connect
- The free 30-second scan reads only your public homepage. No Google account, nothing to revoke.
- Need a certificate we do not hold, or a question this page did not answer? Write to us before you connect anything.
- The long version, with retention and your GDPR rights, is the privacy policy.
- Found a security problem on this site? Write to hello@digiwise.pro.