1. Security Program
Our engineering and operations teams run a security program aligned with industry-recognized standards and controls, including OWASP guidance, the Cloudflare shared-responsibility model, and established best practices for ad-tech supply chains. Security reviews are part of every release, and our infrastructure is continuously tested and monitored.
2. Edge-First Infrastructure
The Ads Platform is delivered from the Cloudflare edge network. This means requests are served from a global, distributed architecture that reduces attack surface and provides built-in DDoS mitigation, Web Application Firewall (WAF) protection, and TLS termination at the point of ingress.
3. Encryption
- In transit — All traffic is encrypted using TLS 1.2 or higher with strong cipher suites. API and tag endpoints are HTTPS-only.
- At rest — Sensitive data is encrypted at rest using modern, industry-standard encryption (AES-256) for storage and processing systems.
- Key management — Encryption keys are managed with strict access control, rotation policies, and separation of duties.
4. Access Controls
Access to production systems is granted on a least-privilege basis, enforced with multi-factor authentication, short-lived credentials, and role-based access control. Access is reviewed regularly and revoked promptly when no longer required.
5. Monitoring & Incident Response
We monitor our platform continuously for anomalies, unauthorized access, and availability issues. In the event of a security incident, we follow a documented incident response process that includes containment, remediation, notification of affected parties where required, and post-incident review.
Our auctions are engineered for high availability, with a target uptime of 99.99%. Tag execution is designed to degrade gracefully so that publisher pages are never blocked by our infrastructure.
6. Vulnerability Disclosure
We welcome coordinated disclosure of security vulnerabilities. If you believe you have found a security issue in the Ads Platform, please report it privately to security@theads.io. We ask that you avoid testing in a way that disrupts production traffic and allow us a reasonable period to remediate before any public disclosure.
7. Contact the Security Team
For security questions, reports, or vendor security questionnaires, contact security@theads.io. For general support, reach our team at info@theads.io.
This statement is a summary of our security posture and does not constitute a contractual guarantee. Security commitments for our partners are governed by our applicable agreements.