Security and access

Adswave requests ads_read. It does not request ads_management.

Meta describes ads_read as access to the Ads Insights API to pull report information. It grants no campaign create, edit, or manage capability. ads_management, which many reporting tools request, lets an app both read and manage ads.

Meta reviewed this permission before granting it. App Review requires a written use case and a screencast showing the login flow and the report data being displayed.

The Google Ads API has exactly one OAuth scope, https://www.googleapis.com/auth/adwords, and it covers both reading and writing. There is no read-only variant to request, so on Google the permission you grant cannot by itself tell you whether a tool will write.

The guarantee therefore rests on behaviour, and the checkable version of that is the list of endpoints Adswave calls. There are three, all reads:

• googleAds:search
• googleAds:searchStream
• customers:listAccessibleCustomers

No mutate endpoint is reachable from the product. One detail that looks alarming and is not: googleAds:search is called with an HTTP POST, because the Google Ads API takes the query in a request body. Judge the endpoint, not the verb.

Adswave keeps no lasting copy of your ad performance data. There is no spend table in the database. Numbers are fetched from Google and Meta when you look at them and held briefly in memory for speed.

That is a deliberate architectural choice rather than a policy promise: if the data is not persisted, there is nothing to breach, nothing to export, and nothing to retain.

Disconnecting Google revokes the refresh token at Google, and the stored secret versions are destroyed rather than disabled.

Meta does not support server-side revocation the same way. To withdraw Meta access fully, remove Adswave in your Meta Business Settings under Business Integrations. Saying otherwise would be easier and would be wrong.

A shared client report is a 256-bit tokenized link. It opens read-only with no login and no account, which is why a client can read it without you provisioning anything.

Rotating the link issues a new token and invalidates the old URL. Turning sharing off stops access but keeps the same token, so rotate the link when you need a URL to stop working permanently.

Adswave holds no SOC 2, ISO 27001, or third-party penetration test report. Claiming otherwise would be the easiest thing on this page to fake and the easiest to disprove, so it is stated plainly instead.

What exists is described above: least-privilege access on Meta, a checkable read-only endpoint list on Google, no ad data at rest, encrypted credentials, and revocation that destroys them.