Trust & security
How Pace protects the ad accounts and data you connect. Where your data lives, who can reach it, what the AI does with it, and what we provide for a security review.
Last updated 8 October 2026 · [email protected]
01
What we do with your data
When you connect an ad account, Pace pulls what it needs to run: campaign and ad-group structure, spend, performance metrics, budget settings, and the OAuth tokens that let it read and adjust those on your behalf.
That data is used to show you your accounts in Pace, and to make the budget changes and recommendations you have set Pace up to make.
We don’t sell it, share it beyond the sub-processors listed below, or use it for anything other than running Pace.
02
Your data does not train AI models
Dot, Findings, pacing recommendations, forecasting and report commentary call frontier AI models through our sub-processors. The model receives a question and the relevant account context, returns an answer, and keeps nothing for training. We don’t fine-tune models on client data, and we don’t share it with any AI provider for theirs.
- Inference only
- Data is sent to answer a question or make a recommendation. It is never used to train a model.
- Approval first
- Fixes suggested by Findings or Dot are only applied after someone on your team approves them.
- Your assistant, your account
- The MCP connector lets Claude or ChatGPT read your Pace data under your own account with that provider.
03
Encryption
Pace runs on Google Cloud (Firebase, multi-region nam5, North America). Encryption is applied by the infrastructure to all data, not configured case by case.
- At rest. AES-256 across Firestore, Cloud Storage and every other Firebase service Pace uses. Google’s documentation.
- In transit. TLS 1.2 or higher on every connection. Firebase accepts HTTPS only. Firebase’s documentation.
- Ad-platform tokens. OAuth refresh tokens are encrypted at rest, isolated per workspace and held server-side. They never reach the browser, and you can revoke them at any time.
04
Access controls
- Sign-in. Google, or a one-time six-digit code sent by email. Pace has no passwords, so there is no password database to breach. When you sign in with Google, your Workspace two-factor policy applies.
- Roles. Owner, Admin and Member roles control who can see and change what in each workspace. Membership is checked on every request.
- Pace staff. Production access is limited to the people who operate the system. Pace support can only enter your workspace after a named teammate approves it. A banner shows everyone in the workspace while access is active, owners and admins can revoke it at any time, and every action support takes is labelled in your change history.
- Audit log. Every change to your campaigns, whether made by Pace or by your team, is recorded in the app. It’s the same log we use internally, with nothing removed.
Pace never sees or stores your ad-platform passwords.
05
Reliability & monitoring
Pace is monitored around the clock by a system we built and run separately from the app. It alerts us the moment pacing stalls, errors climb or an ad platform starts misbehaving. We also review the production logs three times a day.
Incidents are posted on status.paceads.com with updates until they’re resolved, including when the cause sits with Google, Meta or LinkedIn rather than with us.
06
Retention & deletion
While you’re a customer, we keep historical performance data so the pacing engine can model trends, and the change log so you can review your audit history.
Account data is deleted on request. Email [email protected] and we’ll remove it, keeping only the billing and account records that tax and accounting law require.
You can cut off Pace’s access at any time, whether or not you cancel: disconnect the ad account in Pace, or revoke access from inside the ad platform.
07
Sub-processors
Pace is built and run by the Pace team. These are the services it relies on.
- Google Cloud / Firebase
- Hosting, database, authentication and storage
- Microsoft Azure AI Foundry
- AI inference for Dot, Findings, pacing recommendations and report commentary. Not used for model training.
- Google Gemini API
- Text embeddings that help Findings recall past insights
- Stripe
- Payments. Pace never stores card numbers.
- Cloudflare
- DNS, CDN and DDoS protection for paceads.com. The app at app.paceads.com is served directly from Google Cloud, so client ad data does not pass through Cloudflare.
- Ad platform APIs
- Google Ads, Meta, TikTok, LinkedIn, Microsoft Advertising, Reddit, Amazon Ads and X, connected on your behalf
- Operational tools
- Analytics, monitoring, customer support and email delivery
For the complete, current list, email [email protected]. We send it within one business day.
08
Compliance
Pace does not currently hold its own SOC 2 or ISO 27001 certification. The controls below are in place today, and most procurement teams review them alongside our security questionnaire responses.
- Certified infrastructure
- Google Cloud is independently audited against SOC 1, 2 and 3, ISO/IEC 27001, 27017 and 27018, and PCI DSS. Everything Pace stores sits under those controls. Google Cloud compliance
- Payments
- Card data is handled entirely by Stripe, a PCI DSS Level 1 service provider.
- Network
- Tier 1 member of Cloudflare for Startups. paceads.com is served through Cloudflare’s network.
- Legal entity
- Plural Operations Pty Ltd, trading as Pace Ads. ABN 62 700 480 306. Sydney, Australia.
09
Procurement & security reviews
Everything a vendor review usually asks for. Email us with what you need.
- Data Processing Agreement
- Signed on request, alongside standard MSAs with mutual confidentiality terms.
- Security questionnaires
- SIG Lite or your own format, usually returned within a few business days.
- Sub-processor list
- The complete, current list within one business day.
- Architecture walkthrough
- A 30-minute call with our founder on how Pace is built and secured.
Also for vulnerability reports. See the Privacy Policy and Terms of Use for the legal detail.