Every fence, and what each one prevents

Safe enough that we publish every fence rather than an assurance. It runs under your own Google sign-in and can reach only what you can already open; it cannot delete, and a removal by another name is refused on our server; it can be pinned to named accounts or made read-only; and every call is written down, refusals included.

Yes: AdCopilot manages Google Ads with approval — 69 Google Ads tools (as of v2.45.2) exposed to a hosted connector on the full tier, every write run on your instruction in your AI client, and none of the 4 removal tools exposed. Nothing changes until you allow it in your AI client — approval is your client's own tool-permission prompt. If you tell your client to always allow a tool, it will run that tool without asking again — which is why the limits that hold either way are server-side: it cannot delete, it cannot publish a container, it will not switch on the campaign it built, and it asks for your budget before it builds.

No, and we could not. You sign in with Google itself, and Google returns a token for the access you granted. We never receive or store a password. The token is encrypted at rest with its key in a file only the AdCopilot service can read, outside the database, so a copy of the database alone yields nothing usable.

Writes are real writes: an instruction you give is an instruction that runs. Nothing changes until you allow it in your AI client — approval is your client's own tool-permission prompt. If you tell your client to always allow a tool, it will run that tool without asking again — which is why the limits that hold either way are server-side: it cannot delete, it cannot publish a container, it will not switch on the campaign it built, and it asks for your budget before it builds.

No. Those removal tools exist in our fork and are never exposed, so they are not in the tool list your assistant receives. A change carrying the status REMOVED is refused on our server as well, and the refusal is written down. This is not a setting, a dialog or a permission you can be talked into.

Three fences, in order of strength: the tools that delete are not there to be called; the account allow-list refuses any customer ID you did not authorise, whoever asked; and the read-only tier removes every write tool at once. The ledger then makes any attempt visible afterwards.

Yes — the connector is what calls Google for you, so requests and responses travel through it. Queries run live against your account; audit reads are cached for up to an hour and a saved audit's findings for 180 days; we log each tool call; and your workspace's business profile is kept until its owner deletes it.

We hold no SOC 2 and no ISO 27001, and we would rather say so than imply otherwise. We cannot speak for your AI client either — the conversation lives with that vendor, under its policy and your own plan settings. Everything above describes our side of the connection.