Security and access
Adswave reads your Google Ads and Meta accounts. It never writes to them. This page says exactly what that means, because the claim is only worth anything if it is specific.
What Adswave asks for on Meta
Adswave requests ads_read. It does not request ads_management.
Meta describes ads_read as access to the Ads Insights API to pull report information. It grants no campaign create, edit, or manage capability. ads_management, which many reporting tools request, lets an app both read and manage ads.
Meta reviewed this permission before granting it. App Review requires a written use case and a screencast showing the login flow and the report data being displayed.
What Adswave asks for on Google, and why the scope is not the guarantee
The Google Ads API has exactly one OAuth scope, https://www.googleapis.com/auth/adwords, and it covers both reading and writing. There is no read-only variant to request, so on Google the permission you grant cannot by itself tell you whether a tool will write.
The guarantee therefore rests on behaviour, and the checkable version of that is the list of endpoints Adswave calls. There are three, all reads:
googleAds:searchgoogleAds:searchStreamcustomers:listAccessibleCustomers
No mutate endpoint is reachable from the product. One detail that looks alarming and is not: googleAds:search is called with an HTTP POST, because the Google Ads API takes the query in a request body. Judge the endpoint, not the verb.
Your campaign data is not stored
There is no spend or performance table in the Adswave database and no nightly import. Numbers are fetched from Google and Meta when you look at them and cached in server memory: for five minutes, up to 30 while a fresh copy is fetched, and for 24 hours when a date range ended more than 28 days ago.
That is a deliberate architectural choice rather than a policy promise. What the database does keep is the structure you set up (clients, workspaces and linked account IDs, encrypted), your budgets (encrypted), and the figures recorded when an alert fires, kept until you delete the rule, client or workspace.
Disconnecting, and what happens to your credentials
Credentials are stored in Google Cloud Secret Manager, never in the database. Disconnecting Google revokes the token at Google, and the stored secret versions are destroyed rather than disabled.
Disconnecting Meta destroys the stored token as well, but Adswave does not revoke the grant on Meta's side. To withdraw it there too, remove Adswave in your Meta Business Settings under Business Integrations. Figures already cached in memory expire on their own, within 30 minutes for recent data.
Client report links
A shared client report is a 256-bit tokenized link. It opens read-only with no login and no account, which is why a client can read it without you provisioning anything.
Rotating the link issues a new token and invalidates the old URL. Turning sharing off stops access but keeps the same token, so rotate the link when you need a URL to stop working permanently.
Certifications
Adswave holds no SOC 2, ISO 27001, or third-party penetration test report. Claiming otherwise would be the easiest thing on this page to fake and the easiest to disprove, so it is stated plainly instead.
What exists is described above: least-privilege access on Meta, a checkable read-only endpoint list on Google, no spend or performance tables, credentials kept in Secret Manager, and a disconnect that destroys them.
For how data is processed and by whom, see the privacy policy and sub-processors.
Find the drift before your client does.
Connect Google Ads and Meta and see every client's pacing in under five minutes.