Security and data protection, answered in full.

No. Nor SOC 2, nor Cyber Essentials, and no third-party penetration test has been commissioned. ICO registration and the exposure-ledger impact assessment are also open items rather than completed ones. If a certification is a hard procurement requirement, we do not clear it today, and there is no benefit to either side in exploring further. What exists instead is a documented, fail-closed architecture and a published account of what is not held — on this page, rather than discovered in a questionnaire.

Hashed mobile advertising ids are held for at most 90 days, after which they are persistently stripped from the exposure event, re-grading it to a coarser key rather than deleting the record. Campaign configuration, plans and delivery data are held for the life of your workspace and deleted on request. Vendor credentials are encrypted at rest with AES-256-GCM and are deleted when the connection is removed.

Your advertiser workspace is the scope boundary for every route, and a cross-tenant request returns a 404 rather than a 403, because a 403 confirms that the resource exists. Actor, source and client attribution are persisted on every action and readable in the audit log. The disclosure that belongs beside that: the audit log records what came through the API, not what someone with direct database access could read, and during a design-partner engagement that someone is us. No certification attests to how that access is controlled, because we hold none.

No. Agents cannot hold the exact-digest approval permission, cannot resolve human approvals, cannot revoke or replace authority and cannot close missions. Consequential calls fail closed unless the request matches an approval a human granted for those exact bytes, and enabling spend on a staged live line is a separately granted action that approval alone cannot perform.

It varies by segment, which is exactly why it is recorded per segment rather than asserted once. Every compiled plan carries a manifest naming each segment's provider and its basis: consent-chained where the provider asserts a consent chain, legitimate interest where the segment relies on one, and outside scope for cinema and DOOH, which involve no personal data in delivery at all. Where a segment match is weak or a geography is unmapped, the warning stays attached to the plan.

No. Briefs and campaign data are sent to the model provider to produce your output and are not used for training. The whole AI layer also has a complete deterministic fallback, so the product runs with no model provider configured at all.

Yes, because there is no multi-tenant hosted service to be in the wrong place. A deployment today is one that is stood up for you — a single virtual machine running the API, dashboard and MCP server behind a reverse proxy, or the three split across a container host — so residency is a deployment decision rather than a fixed answer. Reporting runs on a Europe/London calendar and the money surface is sterling only.

Four today: Anthropic for the AI layer, Clerk for authentication, Stripe for wallet top-ups and Plausible for cookieless analytics. That is deliberately shorter than the list in our own legal templates, which is wrong in both directions — it names six vendors as active recipients that are fail-closed stubs receiving nothing, and omits the AI media providers that receive prompts once asset production is enabled. A short accurate list is more use to you than a long inaccurate one.

The prepaid wallet is a real exposure and it deserves a straight answer: funds held in a wallet are a claim on Tenhaw LTD, not client money held in a segregated account. Wallet reservations against live campaigns are held until spend is reconciled to the provider's own invoice, which is designed to limit how far ahead of delivery the balance runs. Be exact about the status of that control: reconciling report rows to a provider invoice is one of the unmet conditions in the launch standard, so it has never once operated. And it would not make the balance bankruptcy-remote if it had. Fund what you are about to spend rather than a quarter in advance, and raise it in the design-partner contract if it matters to your finance team.