Is it safe to connect AI to your Google Ads account?

The six questions worth asking any vendor

These are the questions we would ask, in the order we would ask them. Our answers are the rest of this page.

Whose login it uses

You authorise AdCopilot through Google's own sign-in, granting the Google Ads scope to the accounts your Google identity can already reach. Three consequences follow, and they are the useful ones:

• We never see a password. Google returns a token representing the access you granted; that is the whole of what we hold.
• The connector cannot exceed you. If you cannot open an account in the Google Ads interface, your connector cannot touch it either. There is no configuration that widens this.
• Changes are attributed to you. Because the call is made with your credential, Google's change history names you — not “an API client”.

The credential is encrypted at rest, with the key in a root-owned file outside the database, so a stolen database file alone is not enough to use it.

What it cannot do, structurally

The underlying server has thirty-six tools. Four of them delete things: remove_ad, remove_keyword, remove_campaign_asset and remove_asset_from_asset_group. Hosted connectors are served thirty-two. The four are filtered out of the tool list before the model ever receives it.

This is deliberately not a setting, a confirmation dialog or a permission you can be talked into. A confirmation is only as strong as the person reading it at the end of a long day; an absent capability is not negotiable. Everything the agent can do — pause, adjust, add, negate — is reversible.

Which accounts it can reach

By default, everything your Google login can reach. That is fine for one advertiser and too wide for an agency with a manager account, so a connector can be pinned to an allow-list of Google Ads customer IDs.

The check runs on our server, before the Google Ads API is called, on the customer ID in the request itself. A call to an account outside the list is refused and the refusal is recorded with the account that was attempted. Hyphenated and bare forms of an ID are treated as the same account, so 123-456-7890 cannot slip past a list containing 1234567890.

What is recorded

Every tool call: which connector, which tool, which account, whether it succeeded, and a short reason when it did not. Refusals are recorded as deliberately as successes, because “did anything try to reach an account it shouldn't?” is a question worth being able to answer.

What is not recorded is the connector address. Request paths carry the credential, so web-server access logging is switched off for the connector — a log file should never be a place where a working key can be read.

What happens to your data

• Read live, when you ask. There is no copy of your account in a warehouse on our side, because there is no warehouse.
• Not retained. The response goes to your assistant and is not stored by us. What we keep is the audit record — which tool touched which account, not the rows it returned.
• Never training material. Not for us, and we have no model to train.
• Your assistant is its own question. The conversation lives in Claude, ChatGPT or whichever client you connected, under that vendor's policy and your plan settings. If the data is commercially sensitive, that is the policy to read — we cannot make promises on their behalf.

The request path, exactly

Vendors are often vague here, so: your assistant sends a tool call to your private connector address on our server; our server checks that the connector is active, in date, within its rate limit, allowed that tool on its tier, and allowed that account; it then calls the Google Ads API with your credential and returns the result to your assistant.

Your ad data therefore does travel through our server. Any product that tells you otherwise while also querying your account is describing something that cannot happen. What is true is that nothing is retained on the way through.

How to withdraw access

• From your Google account — the third-party access page lists AdCopilot. Removing it revokes the credential at source, immediately, without our cooperation.
• Remove the connector in Claude, ChatGPT or wherever you added it.
• Ask us to switch the address off, or to replace it with a new one if you think it has been seen by someone it shouldn't have. Both take effect on the next request.

An expired trial behaves the same way: the connector is refused before any Google call is made.

What we don't claim

A security page that only lists strengths is not a security page. So, plainly:

• Your connector address is a bearer credential. Anyone holding it holds your access, which is why it lives in an AI client's settings and not in a shared document. This is a constraint of how AI clients accept custom connectors today, not a preference.
• We are not certified. No SOC 2, no ISO 27001. We are a small team and we would rather say so than imply otherwise.
• Writes are real writes. Approval-before-apply exists in the tiers and in the sequence we recommend, but on the full tier an instruction you give is an instruction that executes. Start read-only, scope it narrowly, read the trail.
• We cannot speak for your AI vendor. Everything above describes our side of the connection.

If something here matters to a procurement process and you need it in more detail, ask — we would rather answer a specific question than publish a vague assurance. The team access model and the tool list are the two pages that follow from this one.

Frequently asked questions