Security
Read-only access to your Meta Ads, Google Ads, Microsoft Ads, TikTok Ads, GA4, and Stripe data. AES-256-GCM encryption at rest. SOC 2 Type II infrastructure across the stack. Zero write operations to any connected account — ever.
How Your Data Flows
Your data follows a strict, auditable path across every connected platform. We fetch metrics in real-time and never store raw platform data permanently.
Access & Permissions
We request the minimum scope required: ads_read. This permission cannot create, modify, or delete anything in your ad account. It's enforced by Meta at the API level. The same principle applies to every platform we connect — Google Ads, Microsoft Ads, TikTok Ads, Google Analytics 4, and Stripe — each scoped to its own minimum required read permission (the table below uses Meta as a worked example).
Encryption & Storage
Your Meta access token is the most sensitive piece of data we handle. It's encrypted with AES-256-GCM before storage and decrypted only in-memory when making API requests to Meta.
Meta returns access token via OAuth
EAABs...xxxxx (plaintext, in memory only)
Encrypted with AES-256-GCM
256-bit key + unique IV per token + authentication tag
Stored as ciphertext in Supabase
iv:authTag:encrypted... (never plaintext)
Key separation
Encryption key stored in Vercel environment variables. Database hosted on Supabase. Compromising either one alone is insufficient to read tokens.
Row-Level Security
Supabase RLS policies ensure users can only access their own data. Enforced at the database level.
No Plaintext Secrets
All sensitive values (tokens, API keys) are encrypted or hashed. Nothing sensitive stored in plain text.
Tamper Detection
GCM authentication tags detect any tampering with encrypted data. Modified ciphertext fails decryption.
Authentication
SharpMatter uses passwordless authentication exclusively. No password database means no password breaches. Every authentication method uses modern, proof-based security.
One-time use email links via Supabase Auth. No password to remember, phish, or brute-force. Links expire after use.
Standard OAuth 2.0 with PKCE for connecting your Meta ad account. We never see your Meta password. Token scoped to ads_read only.
For AI clients like Claude Desktop. Full OAuth 2.1 with PKCE, dynamic client registration, and 1-hour access tokens with 30-day refresh rotation.
Managed by Supabase Auth with secure HTTP-only cookies. Sessions are server-validated on every request. Sign out terminates all active sessions.
Infrastructure
We don't operate any self-hosted servers. Every component of our infrastructure runs on SOC 2 Type II certified platforms with TLS 1.3 encryption in transit.
Application hosting, edge functions, and deployment infrastructure.
Database, authentication, and row-level security enforcement.
AI analysis via Claude for the optional built-in chat. MCP connections use the AI client you choose. Your data is never used to train models.
All data in transit encrypted via TLS 1.3
Every connection between your browser or AI client, our servers, each connected platform's API, and (for the optional built-in chat) Anthropic's API is encrypted with TLS 1.3. No exceptions.
Data Retention & Deletion
We retain only what's necessary, for as long as it's necessary. You can delete your data at any time.
Access Tokens & API Keys
Per-platform expiry
Meta tokens expire every 60 days per Meta's policy; other platform tokens and Stripe API keys follow their own provider's refresh or rotation schedule. All are encrypted at rest and destroyed immediately on disconnect or account deletion.
Conversation History
User-controlled
Delete individual conversations or all history anytime from the chat interface. Permanently removed from database.
Business Context
User-controlled
Optional business context you provide (AOV, margins, targets). Editable and deletable from settings.
Error Logs
30-day auto-cleanup
Anonymized error logs for debugging. Automatically purged after 30 days by scheduled cleanup.
Account Deletion
On request
Full account deletion removes all data: tokens, API keys, conversations, context, preferences. Meta data deletion callback also implemented per Meta platform requirements; equivalent revocation is available for every other connected platform via its own disconnect flow.
Compliance
We designed SharpMatter with privacy regulations and platform requirements in mind — not as an afterthought.
Connection Methods
SharpMatter's primary interface is the Model Context Protocol (MCP) server: connect once and query your data from the AI client you already use — Claude Desktop, claude.ai, Cursor, or any other MCP-compatible client — authenticated with OAuth 2.1 + PKCE (or, for Stripe, a scoped API key). The built-in chat is an optional paid add-on with its own encrypted conversation storage, for teams who want a hosted interface without a separate AI client. Both are read-only and encrypted end to end.
Claude Desktop, claude.ai, Cursor, or any MCP client
Hosted chat at sharpmatter.ai
FAQ
No. SharpMatter requests only the ads_read permission from Meta. This is a read-only scope — we can never create, edit, pause, or delete campaigns, ad sets, or ads. Our Meta App Review was approved with this scope specifically verified.
Every OAuth token and API key (Meta, Google Ads, Microsoft Ads, TikTok Ads, Google Analytics 4, Stripe) is encrypted with AES-256-GCM and stored in Supabase (hosted on AWS). Platform metrics are fetched in real-time from each platform's API and are not permanently stored — they're cached briefly for performance, then discarded. If you use the optional built-in chat, conversation history is also stored in Supabase and is deletable anytime.
You can disconnect any connected platform (Meta, Google Ads, Microsoft Ads, TikTok Ads, Google Analytics 4, Stripe) from SharpMatter at any time via the Connect page. This immediately deactivates our access. You can also revoke access directly from the platform itself — for example, Meta's Business Settings under Business Integrations. All methods are instant.
Account deletion removes all your data: encrypted tokens and API keys for every connected platform are destroyed, conversation history (if you used the built-in chat) is deleted, business context is cleared, and your profile is removed. We also implement Meta's data deletion callback, so Meta can request deletion of your data independently; equivalent revocation is available for every other connected platform via its own disconnect flow.
Yes. We never store plaintext tokens or keys. Every OAuth token and API key — for Meta, Google Ads, Microsoft Ads, TikTok Ads, Google Analytics 4, and Stripe — is encrypted with AES-256-GCM using a 256-bit key before it touches the database. The encryption key is stored as an environment variable in Vercel, separate from the database. Tokens and keys are decrypted in-memory only when making API calls to the relevant platform.
No. Your data from any connected platform is never sold, shared, or used to train AI models. The third-party services that may process your data are: Anthropic (Claude — only when you use the optional built-in chat, governed by their enterprise terms; MCP connections send data to the AI client you choose, not through our Anthropic account), Supabase (database hosting), and Vercel (application hosting). All three maintain SOC 2 Type II certification.
We access campaign performance metrics: spend, impressions, clicks, conversions, CPM, CPC, CPA, ROAS, and similar aggregate advertising data. We do not access personal information about the people who see or interact with your ads, your payment methods, or any data from your Facebook/Instagram personal profiles. The same principle — aggregate performance data only, no personal or payment information — applies to every other platform we connect (Google Ads, Microsoft Ads, TikTok Ads, Google Analytics 4, Stripe).
SharpMatter itself does not hold a standalone SOC 2 certification. However, our entire infrastructure stack — Vercel (hosting), Supabase (database), and Anthropic (AI) — are all SOC 2 Type II certified. We do not operate any self-hosted servers, so your data is always on certified infrastructure.
We're happy to answer any questions from your security or legal team. We can also provide additional documentation for your internal review process.