Written for the DPO, the CISO and procurement, and written to survive being printed.
What is enforced in code, what fails closed, what data is held and for how long — and, in its own section, what we do not have yet. The second list is the one worth reading first.
subprocessors receiving data
4
hashed ad-id retention
90 days
certifications and audits held
None
reviewed
1 Sept 2026
published as not held11 items
before you send the questionnaire
Send the DDQ. Most of it is answered on this page, and the parts that are not get the current position rather than a template sentence.
11 things a reviewer will ask for, and the answer to every one.
This section is first, at the same size as the controls, because it is the part of a vendor assessment that decides whether the rest of the conversation happens. Nothing here carries a date, a percentage or a status ladder. A roadmap treatment would turn a list of facts into a list of promises, and no such promises have been made.
ISO 27001
Not held.
No certification, and no audit in progress. This is a young product.
SOC 2
Not held.
No Type I or Type II report exists.
Cyber Essentials
Not held.
The most achievable of the three at this stage, and it is still not held.
Penetration test
Not commissioned.
No third-party test has been run against this platform.
Public OAuth for multi-tenant MCP
An open launch gate.
The server publishes protected-resource metadata and scope challenges, and refuses to mix OAuth with static tokens. What is not done is connecting an authorisation server issuing per-user, per-organisation, audience-bound tokens with PKCE and consent. A static bearer token remains suitable only for a private single-tenant deployment.
A release-evidence PostgreSQL migration set
Partly met.
A PostgreSQL migration set is committed and continuous integration runs a smoke job against PostgreSQL 16 on every push, verifying schema drift, running the migration deploy, seeding and smoke-testing. What is not yet release evidence is the newest work: of the 26 migration directories in the tree, 13 are committed, and our own checklist says untracked migration directories cannot serve as release evidence and the rehearsal must be rerun once they are reviewed and committed. The canonical schema remains SQLite for the zero-config sandbox.
ICO registration and a completed DPIA
Open items.
Registration for the data protection fee and the exposure-ledger data protection impact assessment are both open decisions rather than completed work.
Independent media-quality verification
Not integrated.
No fraud, viewability or brand-safety verification partner is wired in. Placement reporting, supply-path transparency and independent verification are named as unbuilt capabilities.
Support SLA, escalation path or status page
Not built.
There is no service level agreement, no uptime commitment, no on-call rota and no status page. A shared support inbox is listed as a pre-launch item that has not been done.
Reviewed legal templates
Templates, pending counsel.
The privacy policy, terms, data processing agreement and subprocessor list exist as templates and are marked for review with counsel before they are relied on.
A completed DPIA or LIA for a live campaign
Not yet produced.
The lawful-basis machinery produces the evidence a DPIA would draw on, and turning current lawful-basis warnings and manifest conditions into launch gates with completed assessments is named as a pre-launch task rather than a finished one.
If a certification is a hard requirement
Then we do not clear your gate today and there is no benefit to either side in exploring further. That sentence is on the page rather than at the end of a three-week questionnaire cycle, which is the only point in the process where it is still worth anything to you.
What exists instead
A documented architecture that fails closed, a single module allowed to perform identity joins, a retention rule enforced in code rather than in a policy document, and this list. That is a weaker position than a certificate and a more checkable one, and it is the honest description of a young product.
what is enforced
6 areas, and the mechanism in each
Each area names the thing that is actually in the code rather than the intention behind it, because the difference between the two is the whole of what a reviewer is trying to establish. Where a mechanism has a condition attached — the lawful-basis manifest is the clearest case — the condition is in the same paragraph as the mechanism.
01
What data AdBuyMCP holds
Three categories, and it is worth separating them because they have different risks and different retention. Campaign configuration is yours and is held for as long as your workspace exists. Vendor credentials are encrypted at rest and are the highest-value target here. Exposure and outcome data is the category a DPO will ask about, and it is the one with a hard retention rule.
Campaign and plan data
Personas, compiled targeting specifications, plans, creatives, delivery rows and statements, scoped to your advertiser workspace.
Vendor credentials
Encrypted at rest with AES-256-GCM over the JSON-serialised credential object, keyed on SHA-256 of a master key held in the environment. Never logged, never returned by an API read, and the connection store's health is a startup and readiness check rather than an assumption.
Exposure and outcome events
Ad exposures keyed on an opaque household key, a hashed mobile advertising id, a EUID or a postcode sector, plus outcomes you import or that arrive through your own analytics. Hashed advertising ids are held for at most 90 days. Today the ledger is written to only by the deterministic sandbox — there is no inbound ingest route for viewshed panels, CTV logs or IP logs — so the retention rule is in force before there is live data for it to govern.
02
The identity boundary
One module in the whole platform performs identity joins, and everything about the privacy posture follows from that. The exposure ledger — which every channel writes into — never resolves a key back to a person or across key spaces. Resolution happens only in the key-translation service, which is where the retention rule is enforced and the only place a reviewer needs to read to understand what is joined to what.
90-day maximum on hashed advertising ids
After the window, the hashed id is persistently stripped from the exposure event. The event is re-graded to a coarser key rather than deleted, so history is preserved without the identifier.
Multi-key by design
Household key, hashed advertising id, EUID and postcode sector. A spine that depended on advertising ids alone would degrade on a schedule set by Apple and Google; this one loses precision one step at a time and records which step it is on.
Per-key legal grading
Each key space carries its own legal grade, so what may be done with a consent-chained EUID is not what may be done with a postcode sector, and the difference is enforced rather than documented.
03
Lawful basis, as an artefact rather than an assurance
Every compiled channel plan carries a lawful-basis manifest: the provider of each segment used, the basis it relies on — consent-chained, legitimate interest, or outside scope — and the warnings raised while compiling it. It exists so that the answer to "where did this audience come from?" is a document a DPO can read rather than a conversation. What it is not is a compliance guarantee, and the distinction matters: the manifest attaches conditions you still owe, such as requiring a Legitimate Interests Assessment on file for a given source, or verifying a vendor's consent-framework attestation on connection. It tells you what remains to be done. Turning those conditions into enforced launch gates is work we have not finished.
Outside-scope channels are marked as such
Cinema and DOOH delivery involve no personal data — venue catchments, OpenOOH venue types, postcode polygons and dayparts — and the compiler records that they sit outside UK GDPR scope rather than leaving it to be inferred. Movement data is absent from that list because none reaches the product: the Adsquare contract does not exist.
Warnings travel with the plan
A low-confidence segment match, an unmapped geography or an excluded segment all raise warnings that stay attached to the compiled plan rather than being resolved silently.
04
Tenancy and access
Every route is scoped to an advertiser workspace and a cross-tenant request returns a 404 rather than a 403, because a 403 confirms that the resource exists. Authentication runs through Clerk organisations mapped to workspace roots.
Actor class cannot be changed by a header
Every request carries a verified actor class. A human web session paired with the agent source marker is rejected rather than silently taking the browser path, and agent credentials must carry a signed agent claim and a verified client id.
Consequential permissions are server-controlled
Exact-digest approval, operator reconciliation and supplier authorisation are three separate permissions issued only from server-controlled roles. An ordinary human tenant member fails closed with a 403, and agents cannot hold any of them.
Audit trail
Actor, source and client attribution are persisted on every action, and the audit log is readable through both the dashboard and the MCP surface.
05
What fails closed
The useful security question about a young platform is not what it protects but what it refuses to do when something is missing. These are the refusals that are in the code today.
Production will not start without its configuration
Startup fails without Clerk, a strong master key, PostgreSQL, explicit HTTPS origins and a public API asset origin. A legacy plaintext credential row, ciphertext that will not decrypt with the current key, or a missing live credential is a deployment stop rather than a warning.
A launch the wallet cannot fund does not launch
The media spend check is enforced by default; only a sandbox preview may opt into warn-only. Asset production has no warn-only path at all, because a provider cost is incurred at submit.
An ambiguous supplier outcome stops the run
It is never retried and never assumed failed. It raises an exception that requires explicit human resolution, and the operator is handed the vendor, the operation and the idempotency token.
Expired supplier authority raises a spend lock
Before any scheduler work runs. One incident-bound emergency pause is sent, and only a signed human reconciliation clears the stop.
The MCP boundary requires an explicit allowlist
Production must set exact allowed hosts and browser origins — `none` where there are no browser clients. Local execution binds to loopback. Verifier time, request concurrency and JSON body size are bounded, and a request missing its protocol version header is rejected before dispatch.
06
How AI is used, and where it is not trusted
The AI layer runs on Claude for persona extraction, planning, creative pre-check, optimisation and fidelity narration. What matters for a risk review is the boundary rather than the model.
The model never emits a vendor identifier
It extracts semantics; deterministic registry tables emit segment ids by matching those semantics against catalogue keywords. A hallucinated segment cannot reach a buy.
The model does no arithmetic
Every number in a plan is computed deterministically from adapter forecasts. The model explains the plan; it does not calculate it.
Format limits are schemas, not prompts
Copy that exceeds a channel's limit is rejected at the boundary as a validation error rather than truncated on its way to a provider.
Provenance is visible
AI-produced output is distinguished from deterministic fallback output wherever it appears, and with no API key configured the whole system falls back to those heuristics rather than failing.
Your data is not training data
Briefs and campaign data are sent to the model provider to produce your output and are not used to train models.
If your review needs one of these walked through against your own control framework, that is a call rather than a document exchange.
A subprocessor list is only useful if it is a data-flow map rather than a vendor inventory. This one names the parties that receive something today, and the note beside it explains what has been left out and why leaving it out is the accurate choice rather than the flattering one.
AdBuyMCP subprocessors, what each is used for, and what data each receives.
Subprocessor
What it is used for
What it receives
Anthropic
What it is used forThe AI layer: persona extraction, plan explanation, creative drafting and pre-check.
What it receivesCampaign briefs and creative prompts. Not used to train models.
Clerk
What it is used forAuthentication and organisation membership.
What it receivesAccount identity for the people in your workspace.
Stripe
What it is used forWallet top-ups.
What it receivesPayment data, held by Stripe rather than by us.
Plausible Analytics
What it is used forCookieless product and website analytics.
What it receivesPage views with no cookie, no cross-site identifier and no IP retention.
Those four are the product's. This marketing site is a different system with a different list: a cookieless counter that runs for everyone, Google Analytics that loads only if you accept it, Cal.com for the booking calendar, and the same Anthropic account behind the on-page assistant. It is set out on the privacy page rather than merged into the table above, because a website processor and a product subprocessor are not the same commitment and a single list would blur which one you were being told about. Read the privacy policy.
Why 4 and not fifteen
Four, because those are the four that receive anything today. A longer list exists in our own legal templates and it is wrong in both directions: it names six vendors as active recipients that are fail-closed stubs receiving nothing, and it omits the AI media providers that do receive prompts once asset production is switched on. The per-channel supplier list a live deployment would engage is on the supply page, marked by evidence grade, and no data has flowed to any of them. The full list will be published when it is accurate; in the meantime ask, and you will get the current position rather than a template.
The per-channel supplier list a live deployment would engage is graded rail by rail on the supply page. No data has flowed to any of them.
data residency
Where it runs
There is no multi-tenant hosted service yet. A deployment today is one you or we stand up: a single virtual machine running the API, dashboard and MCP server behind a reverse proxy, or the three services split across a container host, or the dashboard on a platform host with the API elsewhere. That means data residency is a deployment choice rather than a fixed answer, and for a UK design partner it can be UK-only. The whole money surface is sterling, reporting runs on a Europe/London calendar, and a connected Google customer's timezone must be exactly Europe/London for the current flight contract.
what this means for a DPIA
Residency is answered per deployment rather than by a corporate address, so the question a DPIA asks — where does this data sit — has a specific answer for your instance rather than a general one for our product.
what it means for procurement
There is no shared production estate to be assessed, and no other tenant on it. That removes a class of risk and adds one: the deployment is stood up rather than bought, and the operating responsibility for it is part of the design-partner conversation rather than assumed.
the money and time surface
Sterling only, reporting on a Europe/London calendar, and a connected Google customer's timezone must be exactly Europe/London for the current flight contract.
engineering evidence
What is actually proved, and by what
A young product has no incident history and no audit report, so the closest thing to a track record is what its own build refuses to let through. Published precisely rather than as “well tested”, because precision is the entire difference between this and the same claim on any other vendor page.
01
An acceptance suite provisions a disposable database at a fixed instant, starts the real API and a production build of the dashboard, and runs human-readable scenarios end to end against them rather than against mocks.
02
A dependency-free browser smoke executes every dashboard page, asserts React hydrated, and fails on an error shell or a severe runtime error.
03
A coverage gate fails the build unless the line-weighted aggregate across the domain packages, the API and the MCP server reaches 90%.
04
Regression tests protect the honesty invariants specifically: targeting, tenancy, prepaid commitments, creative readiness, restart-stable delivery, modelled-reach labelling and retention.
What the evidence does not cover
All of it exercises the deterministic sandbox. A green suite proves the software behaves as specified; it proves nothing about a vendor accepting a request or an invoice reconciling, which is what the supply page grades separately.
cover, contact and currency
The three things a vendor file needs that are not controls
An insurance position, a named counterparty on the register, and a date somebody stands behind. All three are here so the file can be completed without a round trip.
Insurance
Professional indemnity and cyber cover are held by Tenhaw LTD, the operating company, rather than by a product entity. Certificates are available on request during a design-partner conversation. Cover levels are not published here because they are contract-specific.
The counterparty
AdBuyMCP is a product of Tenhaw LTD, a company registered in England and Wales and operating from London. The register entry is the one corroborating fact on this page that nobody here can edit.
Reviewed . That is a date somebody read the whole page against the code, not a build timestamp. If you are reading a printed copy well after it, ask for the current position rather than assuming this one still holds.
This page is written to be printed. Printing it produces an ink-on-paper document with every disclosure open and link targets spelled out, because a security page filed as a blank sheet or with half its answers collapsed is worse than one that was never sent.
running an assessment
Send the questionnaire. The answers will not improve if you wait.
Most due-diligence questionnaires in this category are answered by this page and the supply matrix beside it. The rest get the current position rather than a template sentence, including the ones where the position is that something is not done. Nothing in a questionnaire response will contradict what is written here, because both are written off the same code.
Nine questions, in the order they usually arrive, including the two most vendors answer with a sentence that means nothing: what happens to the data, and what happens to the money.
Are you ISO 27001 certified?
No. Nor SOC 2, nor Cyber Essentials, and no third-party penetration test has been commissioned. ICO registration and the exposure-ledger impact assessment are also open items rather than completed ones. If a certification is a hard procurement requirement, we do not clear it today, and there is no benefit to either side in exploring further. What exists instead is a documented, fail-closed architecture and a published account of what is not held — on this page, rather than discovered in a questionnaire.
How long do you keep personal data?
Hashed mobile advertising ids are held for at most 90 days, after which they are persistently stripped from the exposure event, re-grading it to a coarser key rather than deleting the record. Campaign configuration, plans and delivery data are held for the life of your workspace and deleted on request. Vendor credentials are encrypted at rest with AES-256-GCM and are deleted when the connection is removed.
Who can see my campaign data?
Your advertiser workspace is the scope boundary for every route, and a cross-tenant request returns a 404 rather than a 403, because a 403 confirms that the resource exists. Actor, source and client attribution are persisted on every action and readable in the audit log. The disclosure that belongs beside that: the audit log records what came through the API, not what someone with direct database access could read, and during a design-partner engagement that someone is us. No certification attests to how that access is controlled, because we hold none.
Can an AI agent authorise spend on my account?
No. Agents cannot hold the exact-digest approval permission, cannot resolve human approvals, cannot revoke or replace authority and cannot close missions. Consequential calls fail closed unless the request matches an approval a human granted for those exact bytes, and enabling spend on a staged live line is a separately granted action that approval alone cannot perform.
What is your lawful basis for the targeting data?
It varies by segment, which is exactly why it is recorded per segment rather than asserted once. Every compiled plan carries a manifest naming each segment's provider and its basis: consent-chained where the provider asserts a consent chain, legitimate interest where the segment relies on one, and outside scope for cinema and DOOH, which involve no personal data in delivery at all. Where a segment match is weak or a geography is unmapped, the warning stays attached to the plan.
Is my data used to train AI models?
No. Briefs and campaign data are sent to the model provider to produce your output and are not used for training. The whole AI layer also has a complete deterministic fallback, so the product runs with no model provider configured at all.
Where does the data live, and can we keep it in the UK?
Yes, because there is no multi-tenant hosted service to be in the wrong place. A deployment today is one that is stood up for you — a single virtual machine running the API, dashboard and MCP server behind a reverse proxy, or the three split across a container host — so residency is a deployment decision rather than a fixed answer. Reporting runs on a Europe/London calendar and the money surface is sterling only.
Who are your subprocessors?
Four today: Anthropic for the AI layer, Clerk for authentication, Stripe for wallet top-ups and Plausible for cookieless analytics. That is deliberately shorter than the list in our own legal templates, which is wrong in both directions — it names six vendors as active recipients that are fail-closed stubs receiving nothing, and omits the AI media providers that receive prompts once asset production is enabled. A short accurate list is more use to you than a long inaccurate one.
What happens to my money if you fail as a company?
The prepaid wallet is a real exposure and it deserves a straight answer: funds held in a wallet are a claim on Tenhaw LTD, not client money held in a segregated account. Wallet reservations against live campaigns are held until spend is reconciled to the provider's own invoice, which is designed to limit how far ahead of delivery the balance runs. Be exact about the status of that control: reconciling report rows to a provider invoice is one of the unmet conditions in the launch standard, so it has never once operated. And it would not make the balance bankruptcy-remote if it had. Fund what you are about to spend rather than a quarter in advance, and raise it in the design-partner contract if it matters to your finance team.
what happens next
Bring the control framework you have to satisfy.
In a working session we go through the parts of your assessment that this page does not already answer, and you leave with a written position on each rather than a promise to follow up. Where the honest answer is that a requirement is not met, that is what you will hear, and it is worth more to you before a procurement process than during one.