Last updated: September 16, 2026

These controls describe the current Adwave advertising service. Website integrations and the legacy app can use different systems; their data handling is explained in our Privacy Policy.

1. Account authentication

  • Passwordless sign-in. Email sign-in uses one-time codes rather than a stored Adwave password. Google sign-in is also available on supported Adwave hosts; agency partner hosts use email codes.
  • Two-factor authentication. Optional TOTP 2FA (authenticator apps) with backup codes, enrolled from Settings.
  • Sessions use httpOnly cookies bound to the host you signed in on (our canonical app origin, or an agency partner host).

2. Payments

All payments run through Stripe. Card numbers never touch Adwave’s servers; we store only Stripe’s references. Wallet changes are recorded transactionally in a ledger. Idempotency keys prevent a retried operation from applying the same charge again, and wallet activity shows the entries.

3. Data protection

  • PII hashing. Persistent tracking matching records use salted hashes of email addresses and IP addresses. IP addresses needed briefly for conversion forwarding or TV household matching are stored encrypted with expiry limits. Conversion forwarding can also hold a browser user agent briefly. Account records, lead contact details, and customer imports can contain personal information; hashing does not apply to every record. See the retention schedule.
  • Tenant isolation. Tenant data is scoped to an organization. Users may belong to several organizations, and authorized agency operators may manage their client organizations. Access is checked for the organization involved in each request.
  • Encryption in transit. All traffic is served over TLS, fronted by Cloudflare.

4. API security

API keys are organization-scoped bearer tokens with enforced rate limits (120 reads/minute, 30 writes/minute, export 5/hour). Keys can be revoked instantly from Settings.

5. Infrastructure

Adwave runs on Fly.io with Postgres hosted by Neon, Cloudflare for DNS/CDN/DDoS protection, and continuous error monitoring. Deploys are automated from CI, and a failing build never reaches production.

6. Responsible disclosure

Found a vulnerability? Email support@adwave.com with details and steps to reproduce. We investigate every report and appreciate coordinated disclosure.