Security at Adshift

How we protect your data, your campaigns and your clients' data.

Hosted infrastructure

Adshift runs on providers certified to the highest industry standards.

Our backend infrastructure is hosted on a SOC 2 Type II certified provider (report available under NDA).

Underlying servers run on AWS, certified ISO 27001, ISO 27017 and ISO 27018.

Data hosted in the European Union. DPA and sub-processor list available on request.

Payments are processed by Stripe, PCI DSS Level 1 certified. No card data ever transits or is stored by Adshift.

Adshift is built with a security-by-design approach.

Every sensitive table is protected by strict RLS policies, isolating data per user and per workspace.

Email/password, Google OAuth 2.0 and enterprise SSO. Passwords checked against HaveIBeenPwned.

All data is strictly partitioned by project_id. No cross-workspace leakage is possible.

Data encrypted at rest (AES-256) and in transit (TLS 1.2+). Secrets stored in an encrypted vault.

All sensitive actions (auth, payments, admin access) are logged and retained.

Continuous monitoring of errors, anomalies and intrusion attempts via application logs and admin alerts.

Documents available on request for your legal and procurement teams.

GDPR Article 28-compliant contract available on request, signable electronically.

Up-to-date list of our sub-processors (Lovable Cloud, AWS, Stripe, AI providers) with their guarantees.

User data retained while the account is active, then deleted within 30 days after termination.

Notification procedure within 72h for incidents affecting personal data, GDPR-compliant.

Download our official documents for your legal, procurement and security teams.

Full overview of our security posture (architecture, certifications, technical measures).

GDPR Article 28 compliant data processing agreement, ready to sign.

Our team answers security questionnaires (CAIQ, SIG Lite) and provides the attestations required for your compliance.

Last updated: 2026-09-12