What holds the wall up.
This page describes what we actually do, not what we are certified to do. We hold no audit and no certificate. Everything below is in the product today, and we would rather be held to it than to a badge.
How agencies are kept separate
Every piece of client data we hold carries the agency it belongs to, and every read is answered inside that boundary. It is not a rule anybody has to remember to apply: there is no ordinary path through the product that returns another agency’s clients, and no way for one of our own people to be handed one by asking. We confirm the wall is standing by interrogating the live system rather than trusting that it was set up correctly once — “it was set up” and “it is holding” are different claims, and only the second one is worth telling you about.
What happens when something goes wrong
If the product is ever unsure which agency it is answering for, it stops. It does not guess, and it does not fall back to showing everything. Who you are is checked again at each point that matters rather than once at the door, so a screen that forgets to ask shows less than it should rather than more. And somebody you have given access to a single client account sees that client and no other — on every screen, not on most of them.
The few times we look across agencies
Some administrative work has to see more than one agency: billing, support, a fault you have asked us to investigate. That work is a short fixed list of actions, available to nobody outside it, and permission to use one is decided from your signed-in session rather than from anything the caller can claim about themselves — a check that trusts the asker to say who they are is not a check. Every use leaves a record. If that record cannot be written, the system reports that the action happened and was not recorded, never that nothing happened.
What happens to the access your client gives us
When your client connects their Page, we hold the means to read it. It is encrypted on its own, and the thing that opens it is kept somewhere else entirely — on the machine itself, never in anything we write down, log or put in a link. Each one is tied to the single agency and the single connection it belongs to, so a copy taken anywhere else opens nothing. We can change the outer lock without touching any of the rest, which is what makes changing it something that actually gets done rather than something we intend to do. And an attempt to open one that fails is told nothing useful — the same unhelpful answer every time, so it cannot be used to learn anything by trying repeatedly.
Why a copy of that access is not enough on its own
Every request we make to Meta carries a second proof that only this platform can produce, and that proof is not stored with anything else. Something lifted from a log or a leaked file cannot be used to speak to Meta as us. Nothing that grants access ever travels inside a web address, because addresses are written into access logs, into the servers in between and into browser history; they travel where none of that keeps a copy. And the short-lived access that exists while one report is being made exists in memory for the length of that report and is written down nowhere at all.
What we can and cannot do to your client’s account
We read. We do not post, we do not reply, we do not message anybody, and we do not spend your client’s money. Everything a connection could possibly do is listed in plain language rather than Meta’s — twenty-one permissions, twelve of them reading and nine of them writing — and a new connection starts with the reading on and every one of the writes off. They stay off unless you turn one on yourself. What Meta allowed and what you permitted are two separate questions and both must say yes, which is why “the agency never enabled this” and “this never happened” are the same sentence here. A connection with nothing enabled may do nothing at all: an empty list is read as a prohibition, never as an absence of rules. Six of the twenty-one touch data about members of the public — people who never signed up for anything — and are marked wherever they are shown, because they carry retention and deletion obligations that reading a reach figure does not. And the screen your client sees when they connect asks them to pick the one Page this is about, not to hand over their whole portfolio.
The links that go to people with no account
Two kinds of link reach somebody who has no account here: the one that lets your client connect their own Page, and the one that lets them read the report you sent. Neither can be guessed, and we keep no copy of either — what we store can confirm a link is genuine but cannot reconstruct it, so a leaked database yields no working links. Every link expires, and expiry is not optional. Revoking a link is separate from its expiry, so a report forwarded into a group chat can be shut off without anyone having to remember it was sent. Views are counted, and the file behind the link checks the expiry and the revocation itself rather than assuming something earlier already did.
What is switched off
Nothing reaches a client that you have not approved, by hand or through rules you signed. Reports stop and wait for you by default. Sending on its own is something you have to switch on deliberately, and even then it will not send a report that failed its checks or produced no file. Before a scheduled report begins, the period it covers is claimed, so a restart, an update landing halfway through, or a second copy of the work starting by accident produces one report rather than two in your client’s inbox — and that claim is never given back, because a report that may already have reached a client is the worse thing to send twice. A delivery that fails, or a channel that was never set up, is recorded as a delivery that did not happen, and the report says so.
What happens when a client leaves
Your client does not need our permission to end this. They can withdraw what they granted from inside their own Meta settings at any time, and nothing further can be read. A report link you have already sent can be revoked separately from its expiry, so a report can be taken back after it has gone out. Beyond that there is a published page of data-deletion instructions, and a deletion request Meta itself can send us, and both are answered without anybody signing in — a reviewer, a regulator and a member of the public all arrive without an account, and sending them to a sign-in screen is the same as not publishing the policy at all. A deletion request we cannot prove came from Meta is refused rather than acted on. Every request that does arrive is recorded and worked by a person, because answering “done” and deleting nothing is precisely the failure this exists to prevent. What is kept after a deletion, and for how long, is stated on the instructions page itself; it is linked at the foot of this one, and it says more than we would say here.
What we do not claim, and why
We hold no SOC 2 report, no ISO 27001 certificate and no completed data-processing audit. A published privacy policy is not a certification, and we do not present it as one. We quote no service level agreement and no uptime figure: a number nobody outside this company can check is decoration, and we would rather be held to what is written above. The platform runs on a single machine, and we say so plainly rather than sell you the name of a tier. “Enterprise-grade”, “bank-grade” and “battle-tested” appear nowhere on this site. Everything above is specific, it is in the product today, and you can ask us to show you any of it working — a smaller claim than a certificate, and one you can actually test.