Skip to main content
Mablens
security & data

Access, storage, and encryption - stated honestly.

Mablens holds the connections to your store and ad accounts. We take that seriously. This page describes exactly what we store, for how long, what access we ask for, and how we protect it.

Encryption in transit and at rest

encryption

All network traffic uses TLS 1.2 or higher. Data at rest is encrypted using AES-256 in our managed database and object storage.

Least-privilege API scopes

scopes

For each connected platform, we request the minimum scope required for the factory to run. Scopes are documented per platform and revocable at any time.

Auditable actions on your ad accounts

audit

Every campaign create, edit, pause, or delete performed by Mablens is logged and available in your workspace activity view.

what we store

What lives on Mablens, what does not.

We store the least amount of data required to run the ad factory. Some data comes into Mablens for processing; some stays on your platforms and is read only when needed.

Stored on Mablens
  • Product listings from your connected stores
  • Generated creative assets (video, image, copy)
  • Campaign metadata (structure, targeting, budget, status)
  • Performance metrics needed for optimization
  • Workspace configuration and user roles
Not stored on Mablens
  • Customer PII from your store orders
  • Payment or card data of any kind
  • Full ad platform credentials (we hold OAuth tokens, not passwords)
  • Data from platforms you have not connected
  • Anything outside the workspace you connected
retention

How long we keep what we keep.

Category
Retention
Notes
Product listings
Duration of connection
Purged within 30 days of workspace deletion.
Generated creative
Duration of connection
Kept so campaigns and reporting stay consistent. Exportable on request.
Performance metrics
Rolling 24 months
Aggregated after 24 months for reporting continuity.
OAuth tokens
Duration of connection
Revoked immediately on disconnect.
Workspace logs
Rolling 12 months
Includes audit log of actions taken on ad accounts.

Revocable, at any time

control

Disconnect any platform from the workspace. Mablens stops reading and stops writing on that platform immediately.

Isolated workspaces

isolation

Each Mablens workspace is scoped to the stores and ad accounts you connect to it. No cross-workspace leakage.

Incident response

response

Suspected incidents follow a documented response process. Affected workspaces are notified with impact scope and remediation.

compliance posture

Where we are today - stated as-is.

Mablens is a growing platform. We treat security as a discipline in progress, not a certificate on a wall. Below is where we actually are today. We update this page as posture changes.

Encryption

TLS 1.2+ on all network traffic. AES-256 at rest for managed databases and object storage.

Access controls

Role-based access on the workspace. Internal access to production data is scoped to on-call operators with individual accounts and MFA.

Data location

Data resides in cloud-hosted infrastructure with region selection available on Scale tier.

Third-party audits

Formal third-party audit reports are not yet published. We are building toward SOC 2 Type II. This page will list the current status when it changes.

Data subject requests

Export and deletion requests can be raised from the Contact page. Turnaround is within 30 days for standard requests.

Vendor security

Sub-processors used by Mablens are documented and reviewed. Full list available on request.

common questions

The ones we get most often.

Can we sign a mutual NDA before evaluation?

+
Yes. Reach out through the Contact page and we will send our standard mutual NDA - or review yours.

Do you support region-specific data residency?

+
Region selection is available on the Scale tier. Reach out to discuss specific residency requirements.

How do you handle a request to delete our data?

+
Deletion requests are honored within 30 days. Generated creative and campaign structure tied to your workspace are removed. Aggregated, non-identifying performance metrics may be retained for platform-level analytics.

Have a specific security question we did not cover?

Reach out through Contact - we will get a real answer to you, not a boilerplate reply.

Contact salesConnect your store