ayako
Sign inGet Started

Security & data protection

Ayako connects to your LinkedIn Ads account, so we take how that data is protected seriously. Here’s exactly how it works — no vague reassurances, just what’s actually in place.

Last updated: 17 July 2026

Certified infrastructure

Hosted on Vercel and Supabase — both SOC 2 Type II and ISO 27001 certified. Ayako itself doesn’t hold a separate certification; it inherits the controls of the infrastructure it’s built on.

Encrypted, always

All data is encrypted in transit (TLS) and at rest (AES-256). LinkedIn access tokens get an extra layer of encryption at the application level before they’re ever written to the database.

Read-only LinkedIn access

Ayako only ever requests read scopes from LinkedIn’s Ads API. It cannot pause campaigns, change budgets, or edit anything — technically incapable of it, not just policy.

EU data residency

Your account and campaign data lives in Supabase’s Frankfurt, Germany region — inside the EU, satisfying both GDPR and the Swiss nDSG/FADP.

Infrastructure

  • Hosting: Vercel — SOC 2 Type II compliant, ISO 27001:2013 certified, and certified under the EU-US Data Privacy Framework.
  • Database & authentication: Supabase — SOC 2 Type II compliant and ISO 27001 certified, hosted in the Frankfurt, Germany (eu-central-1) region.
  • Row Level Security: every table in the database has RLS policies enforced at the database level — a logged-in user can only ever read their own account’s data, not just by application logic but by the database itself refusing anything else.

Encryption

  • All traffic runs over HTTPS/TLS — nothing is ever sent unencrypted.
  • Data at rest is encrypted with AES-256, standard on both Vercel and Supabase.
  • LinkedIn access and refresh tokens get an additional layer of application-level encryption before they’re written to the database — even direct database access wouldn’t expose a usable token.
  • Tokens are never returned to the browser, never logged, and only ever used server-side.

LinkedIn integration

Connecting your LinkedIn Ads account uses LinkedIn’s official OAuth 2.0 flow. Ayako requests only read-level scopes (r_ads, r_ads_reporting) — never the write scope (rw_ads) that would allow pausing campaigns, changing budgets, or editing anything. This isn’t a policy we’ve chosen to follow; the access we hold makes it technically impossible. Every change to your campaigns still happens in Campaign Manager, by you.

Authentication & access

  • Sign-in uses Supabase Auth — passwords are never stored in plain text, only as a salted hash.
  • Sessions use short-lived JWTs, refreshed automatically.
  • Within a team account, members only see what their role allows — team members never reach billing or account settings.

Payments

Billing is handled entirely by Paddle, our merchant of record — a PCI DSS Level 1 certified payment provider. Ayako never receives or stores your full card number; Paddle handles checkout, billing, and tax collection directly.

AI processing

Ask Ayako and the recommendations engine are powered by Anthropic’s Claude API. Campaign data sent to generate a response is processed under Anthropic’s commercial API terms, which include a Data Processing Agreement and — unlike Anthropic’s consumer chat products — do not use API data to train models by default.

Data retention & deletion

After a subscription is canceled or a trial expires, your account is frozen (access paused, nothing deleted) for a 60-day grace period, after which your data is permanently deleted unless you resubscribe. You can request deletion sooner at any time — see our Privacy Policy for the full retention schedule.

Compliance

Ayako is designed to comply with GDPR (EU) and the Swiss nDSG/FADP — both cover data minimization, the right to access and erase your data, and breach notification. A Data Processing Agreement is available on request for business customers who need one. Full detail on legal basis, sub-processors, and your rights lives in our Privacy Policy.

Reporting a vulnerability

Found something that looks like a security issue? Email hello@ayako.io with details — we take every report seriously and will respond directly.