Your ad accounts generate real revenue. We treat their security accordingly. Eleven isolation layers, zero password storage, AES-256 at rest, TLS 1.3 in transit, no third-party trackers, and publicly verified business identity.
Auth.js v5 + Upstash
Authentication, sessions & rate limiting
Meta Marketing API
Official platform OAuth v21.0
Supabase / AWS RDS
AES-256 encrypted data at rest
Vercel Edge
TLS 1.3 global CDN delivery
Stripe
PCI DSS Level 1 payments
No Third-Party Trackers
No analytics or ad pixels loaded
Next.js Edge Headers
CSP, X-Frame-Options, Permissions-Policy
Google Business
Publicly verified business listing
Trustpilot
HMAC-signed verified customer reviews
Algerian Gov. Registry
Official business registration ID
Defense in Depth
Each layer independently mitigates a distinct threat surface. Compromising one doesn't compromise the next.
Every session is authenticated via Auth.js v5 (NextAuth) — enforcing HS256-signed JWTs stored exclusively in httpOnly, Secure, SameSite=Lax cookies. Credentials are validated server-side against bcrypt hashes; Google OAuth uses the official PKCE flow. Brute-force lockouts are enforced at the route layer via Upstash Redis rate limiting — 5 attempts per email per minute, 20 per IP per minute, with fail-open on Redis outage. Unverified emails are blocked from accessing the dashboard.
When you connect your Meta ad account, we initiate Meta's official OAuth 2.0 Marketing API flow. You authenticate directly on Meta's domain — we never see your password. The resulting access token is stored server-side as an httpOnly, Secure, SameSite=Lax cookie — invisible to JavaScript, immune to XSS injection. The same token is also persisted server-side in your isolated database row as a backup. You can revoke access from Meta's Security Settings at any time.
All user data is stored in Supabase PostgreSQL running on AWS infrastructure in eu-west-1 (Ireland). AWS RDS enforces AES-256-XTS encryption on every storage volume by default — keys managed via AWS KMS with automatic annual rotation. Our service role key, the only credential that can bypass row-level policies, lives exclusively in server-side environment variables — it has never touched a client bundle or browser context.
All traffic between your browser and AdHorde traverses Vercel's global edge network over TLS 1.3 — the latest protocol, with removed legacy cipher suites and perfect forward secrecy via ECDHE key exchange. HTTP Strict Transport Security headers with a 1-year max-age ensure your browser never falls back to plaintext. Every plaintext HTTP request is permanently redirected to HTTPS at the edge.
Every HTTP response from AdHorde — pages, API routes, and static assets — is served with a full suite of hardened security headers enforced at the Next.js edge layer. Content Security Policy restricts exactly which origins can load scripts, styles, images, and frames — blocking any unauthorized injection at the browser level. Clickjacking is blocked via X-Frame-Options: DENY and CSP frame-ancestors: none. MIME-type sniffing attacks are blocked via nosniff. Camera, microphone, geolocation, and payment hardware APIs are all explicitly disabled via Permissions-Policy. API routes additionally carry Cache-Control: no-store to prevent any sensitive response from being stored in CDN or browser caches.
Every API endpoint enforces per-IP rate limiting at the application layer via Upstash Redis. The AI chat endpoint limits to 20 requests per minute per IP. Campaign creation, credit operations, and automation writes all have independent limits. Requests that exceed limits receive a 429 with a Retry-After header — they're never queued for delayed execution.
All payment processing is delegated to Stripe — a PCI DSS Level 1 Service Provider, the highest certification tier possible. Your card number, CVV, and expiry date are captured directly by Stripe's JavaScript SDK on Stripe's domain and are tokenized before any data reaches our servers. What we receive is a Stripe token reference, never raw card data. Webhook events are validated via HMAC-SHA256 signature verification on every delivery — spoofed events are cryptographically impossible to forge.
AdHorde does not load any third-party advertising or analytics trackers — there is no Google Analytics, no behavioral pixel, and no session-recording SDK anywhere on the site. The only third parties involved are the operational providers required to run the Service (Stripe for payments, Supabase/AWS for the database, Vercel for hosting). Because we don't run tracking scripts, our Content Security Policy can lock connect-src and script-src down to a strict allowlist, blocking unauthorized third-party requests at the browser level.
Admin operations generate immutable audit log entries in PostgreSQL: action type, timestamp (UTC), admin user ID, target user ID, email, and a full JSON diff of what changed. Automation rule events — rule created, edited, fired, paused, deleted — are logged with millisecond-precision timestamps. Both logs are write-append-only from the application layer — there is no delete endpoint exposed to admin users.
AdHorde is an officially registered digital services business under Algerian law (Domain 020000 — Digital services and related activities, Activity Code 021626). The business is publicly listed on Google Business Profile and searchable by name. Domain registration is verified through Squarespace Domains with accurate ICANN contact information. Business details are published on ScamAdviser with the official government registration ID.
AdHorde is registered on Trustpilot and implements their In-App Verified Review Collector — a cryptographically signed review system where every review invitation is tied to a real authenticated user session via HMAC-SHA256 signature. Fake or incentivized reviews are structurally impossible. Every paying customer automatically receives a Trustpilot review invitation after subscription, ensuring review authenticity at the platform level.
Data Handling
We Store
We Never Store
Infrastructure
We don't build security from scratch — we compose it from best-in-class providers, each with independent third-party audits.
Auth.js v5 + Upstash Redis
Authentication & Rate Limiting
AWS RDS (via Supabase)
Database
Stripe
Payments
Next.js Edge Headers
Browser Hardening
We take security reports seriously. If you've identified a vulnerability in our platform, please disclose it responsibly. We'll acknowledge your report within 24 hours and keep you updated throughout the resolution process.
Report a Vulnerability →[email protected] · We respond within 24 hours