Security
Built to be accountable.
How AdHelm gets access to your Google Ads account, what that access can do, and what stops it doing more. Written for whoever on your team asks the hard questions.
OAuth access
You grant Google Ads access through Google. AdHelm never sees or stores your Google password, and you can revoke access from your Google account at any time.
Tenant isolation
Workspace data is scoped per tenant, and access is checked server-side on every request. The storage layer is designed for tenant isolation.
Plan gate, server-side
Whether AdHelm may write to your account is decided on our server, on every mutation route. On Watch the answer is always no.
What the OAuth token can actually do
Google Ads has one API scope: auth/adwords. It covers reading and writing together. Google does not offer a read-only version, so the token AdHelm holds is technically capable of writing to your account on every plan, including Watch.
What actually stops a write is the plan gate on our server, checked on every route that could touch your account, before the request reaches Google. And anything that does get applied is written to a change ledger with the value it replaced. We would rather tell you that than claim a permission level Google does not sell.
We request one further scope, auth/datamanager, used only to send conversion events back to Google for accounts that turn that on.
Caps on every run
These are the defaults. They are your settings, so you can lower them, and a change beyond a cap is refused and reported rather than made.
- Daily budget increaseNo more than 15% in a day
- Budget moved between campaignsNo more than 10% per run
- Bid adjustmentNo more than 10% per run
- Keyword pausesUp to 3 per run
- Negative keywords addedUp to 10 per run
- Changes of any kind10 per run, 50 per day
Other safeguards
- Undo: every applied change stores the value it replaced. You can reverse it for 30 days.
- Reasoning: every recommendation says what it found and how confident it is, before you approve it.
- Alerts: pacing warnings and a weekly report, so nothing drifts while nobody is looking.
- Logs: account changes, product actions, and operational events are recorded so a question can be answered later.
- TLS in transit, and Google Ads refresh tokens encrypted with AES-256-GCM before storage.
What we do not have
No SOC 2 report. No penetration test to hand you. No BAA. If your procurement process needs one of those, we are not there yet, and you should know that before you pay rather than after.
PHI and HIPAA
AdHelm is an advertising tool. It does not ask for clinical data and does not store any: no symptoms, no diagnoses, no treatment history, no test results, no clinical notes. Do not type any into it. We do not offer a BAA and we hold no HIPAA certification. If your practice needs either, tell us before you buy — today the answer is no.
Security questions go straight to a human: support@ad-helm.com
See it read-only first.
The audit connects, reads 90 days, and changes nothing. Free, and no card.