1. Security principles
DADTrack uses a private, role-based workspace model. The goal is to give each authorized person the minimum workspace access needed for their work while keeping platform connections under owner or administrator control.
Server-side token handling: Platform access tokens are processed on the server side and are not intended to be exposed in the public browser interface or committed to source control.
2. Access controls
- Invite-only account access for private workspaces.
- Workspace roles and assigned scope determine which data a user can view or manage.
- Integration and connection settings are separated from ordinary reporting access.
- Authentication events and important operational changes may be recorded for security and audit purposes.
- Access can be removed by the workspace owner or administrator when it is no longer required.
3. Platform connections
When a workspace owner authorizes Meta, Google, TikTok, AppsFlyer, or another connector, DADTrack uses the permission granted by that platform to request data. The platform remains the source of record for its own account permissions, billing, attribution definitions, and revocation controls.
Tokens and connector configuration are treated as sensitive. Users should never paste a token, password, or private key into a public issue, screenshot, chat, or client-side code.
4. Data integrity and source labeling
DADTrack separates platform sources and reports unavailable or partial metrics rather than silently converting missing values into zero. This helps operators distinguish real platform results from data that has not been returned, is delayed, or is outside the selected scope.
Users should still verify important decisions against the official platform interface, especially when a platform applies modeling, attribution windows, sampling, or reporting delay.
5. User responsibilities
- Use a unique, strong password and do not share account credentials.
- Review invitations and role assignments before granting access to a teammate.
- Revoke platform connections that are no longer needed.
- Report suspected account compromise, unauthorized access, exposed secrets, or unexpected connector behavior promptly.
6. Reporting a security issue
Send a concise report to nghiadt2702@gmail.com. Include the affected page or workspace, a description of the behavior, approximate time, and safe reproduction details. Do not include passwords, access tokens, or full personal data in the first message.
We may ask for additional information to verify the report and assess impact. Please allow us to investigate before publicly disclosing an unresolved issue.
7. Infrastructure and third parties
DADTrack may rely on hosting, database, authentication, monitoring, and platform API providers. These providers have their own operational and security controls and process data according to their applicable terms and instructions. Availability can also be affected by a connected platform or infrastructure provider.
8. No absolute guarantee
Security is an ongoing process and no online service can promise absolute protection. We review the service and configuration as it changes and will take reasonable steps to investigate and respond to security events.