How Odak keeps your Google Ads data safe
Odak Ads connects to Google Ads with Google’s own sign-in, stores that connection encrypted, keeps every customer’s data apart in the database itself and records who changed what. Here is what that means in practice, and where the limits are.
- Google connection
- Google sign-in (OAuth) with the Google Ads scope; Odak never sees your Google password
- Stored tokens
- Refresh tokens encrypted (AES-256-GCM); never shown in the app, logs or API responses
- Customer data
- Separated per organization by row-level security in PostgreSQL
- In transit
- Encrypted (TLS)
- Sign-in
- Two-step sign-in with an authenticator app and backup codes · session list with sign-out
- Records
- Audit log for team, connection and billing events · History for every ad change
- Payments
- Handled by Paddle; Odak never sees card numbers
What the Google Ads connection lets Odak do
You connect an account by signing in with Google and approving access to Google Ads. Odak asks for the Google Ads permission and your e-mail address, nothing else. It keeps only the refresh token Google returns, encrypted, and uses it to read your account and to send the changes you confirm.
Odak can
- Read campaigns, keywords, search terms and reports
- Send the changes you or your team confirm
- Create the Search campaigns you publish
Odak cannot
- See your Google password
- Read your Gmail, Drive or other Google data
- Change anything on its own: there are no automatic rules
How your data is kept apart
Every organization’s data lives in the same database but is separated by PostgreSQL row-level security: each query runs for one organization, and the database itself refuses rows that belong to another. The application connects with a role that cannot switch this off.
Connections are stored per organization. One customer’s connection is never used for another customer’s accounts, and one broken connection only affects the projects that use it.
Who can do what
Each person has one role in an organization: Owner, Admin, Editor or Viewer. Only Owners, Admins and Editors can change ads; only Owners and Admins manage members, connections and billing. Every change to an ad account is written to History with the person’s name, and team, connection and billing events go to the audit log.
Signing in
Accounts sign in with e-mail and password (e-mail verified, at least 8 characters, with rate limits on sign-in and password reset). Anyone can turn on two-step sign-in with an authenticator app and ten backup codes. Settings lists every device you are signed in on, and you can sign any of them out; that session stops working at once.
Your data, your call
The Privacy Policy lists what is processed, why, by which services and for how long.
- Export: download your personal data as a JSON file from Settings at any time.
- Delete your account: your sign-in and personal details are removed; the history organizations keep shows “Former member” instead of your name.
- Delete an organization: the Owner can delete it with all of its data from Settings.
- Revoke access: remove a connection in Odak, which also revokes the token at Google, or revoke Odak in your Google account.
What Odak does not offer yet
There is no single sign-on (SAML), no way to make two-step sign-in mandatory for a whole team and no access limited to single projects. If you need one of these today, write to [email protected] and tell us.
Security questions
Can Odak employees see my Google Ads data?
Your data is used only to provide the service, as the Privacy Policy describes. Connection tokens are encrypted, so they cannot be read from the database.
How do I disconnect Odak from Google Ads?
Remove the connection in Settings › Connections; Odak revokes the token at Google at the same time. You can also remove Odak from the third-party access list in your Google account.
Where is my data hosted?
On the servers of our hosting provider. The Privacy Policy names every service that processes your data and where transfers outside your country are covered.
What if something goes wrong?
Write to [email protected]. If personal data is affected we inform you and the authorities as the law requires, and you can sign out every session and remove connections yourself at any time.
Calm about your data, too.
Start your free trial with the sample project; nothing is connected until you choose to.
7 days free · No card required