Wie wir Ihre Daten schützen
You trust us with access to your ad accounts, CRM data, and analytics. This page lists the concrete measures we apply to protect that data.
Was auf der Plattform umgesetzt ist
Technical measures at the traffic, storage, authentication, and infrastructure layers
Datenverschlüsselung
TLS 1.3 for all traffic. Integration OAuth tokens are stored encrypted (AES-256). Passwords use bcrypt with cost factor 12.
Sichere Authentifizierung
Two-factor authentication (2FA). OAuth 2.0 for all integrations. JWT with automatic key rotation. Brute-force protection via rate limiting.
Datenisolierung
Multi-tenant architecture: each workspace's data is isolated at the database level. Access to other tenants' data is not possible at the query layer.
Aktivitäts-Audit
All user actions (login, password change, integration connection, data export) are recorded in an immutable log with IP and device info. Retention: 12 months.
Sichere Cookies
Auth cookies are marked HttpOnly, Secure, and SameSite=Strict. CSRF protection uses double-submit cookies plus X-Requested-With.
Perimeterschutz
Cloudflare WAF at the edge, DDoS protection, and automatic IP blocking when limits are exceeded. nginx with configured security headers (HSTS, CSP, X-Frame-Options).
Einhaltung der Anforderungen
We operate in line with Russian Federal Law 152-FZ on personal data. For users in the EU and US, additional rights under GDPR and CCPA apply — see /privacy.
The full list of subprocessors, processing purposes, and retention periods is published at /privacy.
Unsere Engineering-Praktiken
Prinzip der geringsten Privilegien
We request only the OAuth scopes the service cannot function without. Within the team, access to production data is role-based.
Parametrisierte Abfragen und Eingabevalidierung
All database queries are parameterized. Server-side HTML sanitization. CSP for XSS protection.
Secret-Rotation
JWT keys rotate every 90 days with a 7-day overlap. The OAuth token encryption key rotates every 180 days with background re-encryption.
Reproducible Builds und Abhängigkeits-Audit
CI runs a dependency vulnerability scanner on every merge. Container builds are deterministic.
Schwachstelle gefunden?
We value the contribution of security researchers. If you have discovered a vulnerability in our system, please report it to us confidentially.
If you followed this disclosure channel in good faith, we will not pursue legal action against you.
[email protected]Legal information
AdMetric is a marketing analytics platform. Services are provided by two legal entities:
- AdMetric LLC / ООО «АДМЕТРИК» (TIN/INN 9726112159, PSRN/OGRN 1267700088391, Russian Federation) — serving customers in the Russian Federation, accepting payments in Russian rubles, and processing personal data in accordance with Russian Federal Law No. 152-FZ.
- Sole Proprietor Sobolev / ИП Sobolev (Republic of Kazakhstan) — serving customers outside the Russian Federation, international payments, and integrations with international advertising and analytics platforms.
The personal data operator is the legal entity with which the user has entered into an agreement; it is determined by the user’s country of registration and is specified in payment documents.
Single contact address for personal data requests: [email protected].