Security
MetricPilot is a reporting and analytics product. It reads advertising performance data you explicitly authorise — from Google Ads, Meta Ads, GA4 and Search Console — and turns it into dashboards, AI summaries and PDF reports. This page describes the controls that are in place today for both the Google and the Meta integrations.
OAuth 2.0 authorisation
MetricPilot connects to Google Ads through Google's official OAuth 2.0 flow and to Meta Ads through Facebook Login on facebook.com. You review each consent screen on the platform's own domain and approve access yourself. MetricPilot never asks for, sees, or stores your Google or Facebook password.
Least-privilege Google scope
We request a single Google scope, https://www.googleapis.com/auth/adwords, which is the scope required to read reporting data through the Google Ads API. We do not request Gmail, Drive, Contacts, Calendar or any other Google user-data scope.
Least-privilege Meta permission
We request a single Meta permission, ads_read, which is the minimum the Meta Marketing API needs to list your ad accounts and read their insights. We do not request ads_management, business_management, Pages, Instagram publishing, Commerce, Messenger or Leads permissions, and we request nothing the product does not use.
Read-only usage
MetricPilot issues reporting queries only, on every platform. The application contains no functionality to create, edit, pause, resume or delete campaigns, ad groups, ad sets, ads, keywords, bids, budgets, audiences, creatives or pixels, and no functionality to create advertising accounts, publish to a Page or Instagram account, or serve advertising.
Encrypted token storage
Google and Meta access and refresh tokens alike are encrypted with AES-256-GCM using a server-held key before they are written to the database. Ciphertext is stored in a table that application users cannot read; only server-side code can decrypt it.
Server-side API calls
All Google Ads API and Meta Marketing API requests are made from our server. Tokens are never sent to the browser, never placed in URLs, and never exposed in client-side JavaScript.
Encryption in transit
The application and all API traffic are served exclusively over HTTPS with TLS. HTTP requests are redirected to HTTPS.
Access control
Every record belongs to a workspace. Database row-level security policies restrict reads and writes to the owning account, so one customer's data is never returned to another. Tables holding OAuth secrets deny all direct client access.
No password storage
Sign-in uses Google sign-in or an email and password managed by our authentication provider, which stores only salted password hashes. MetricPilot application code never receives a plaintext password.
Token expiry and refresh
Access tokens are short-lived and expire automatically. Google tokens are refreshed server-side only while your connection is active; Meta long-lived tokens carry their own expiry and simply stop working when it passes, prompting you to reconnect. Short-lived OAuth state values expire after ten minutes and are single-use, which protects the callback against CSRF and replay.
Revocation and disconnection
You can disconnect any platform inside MetricPilot at any time, which deletes the stored tokens from our database immediately. You can also revoke access independently at myaccount.google.com/permissions for Google, or under Facebook settings → Business integrations for Meta.
Infrastructure
MetricPilot runs on managed cloud infrastructure with encrypted storage at rest, automated backups and restricted administrative access. Application secrets are held in a managed secret store, not in source code.
Reporting a vulnerability
If you believe you have found a security issue, email contact@metricpilot.in with the details. We acknowledge reports within two business days and will keep you updated until the issue is resolved.
This page is maintained by the MetricPilot team and describes our own practices. It is not an independent certification or audit report.