Security & Trust
The answers your IT lead will ask for.
Where your data lives, who can see it and what happens if something goes wrong — in plain language.
Encryption
TLS 1.2+ in transit and AES-256 at rest. Third-party access tokens are encrypted separately.
Access control
Role-based permissions per product, SSO on Scale plans, and two-factor sign-in.
Audit trail
Sign-ins, exports, permission changes and approvals are logged and exportable.
Compliance
Built to meet GDPR, UK GDPR and CCPA/CPRA, plus India's DPDP Act where it applies.
Questions, answered
Something else? Ask us directly — a person replies within one working day.
Do you sell or share our data?
No. We process your data only to provide the service, and only share it with sub-processors listed in our DPA.
Can we get a security questionnaire filled in?
Yes. Email security@optimml.com and we'll reply within five business days.
How do you access our ad accounts?
Through official OAuth connections with the minimum permissions needed. ReportVault uses read-only access wherever the platform allows.
Questions from your security team?
We'll walk through our set-up and fill in your questionnaire.