Security by design
Security
LidFly separates authorization, provider access, AI context, and advertising writes so that each boundary can be controlled and audited.
Last reviewed: 26 August 2026
Current status
The platform foundation is online. Google Ads production connectivity remains in development and will not be represented as generally available until the required Google approvals and production safeguards are in place.
Provider credentials
The production design stores provider credentials in encrypted secret storage and keeps raw tokens, authorization headers, and customer lists out of logs and AI context. Connections can be revoked without rotating unrelated user credentials.
Advertising writes
Read and write capabilities are separated. Budget, campaign, audience, and creative mutations require a declared risk level and an approval policy. Writes use idempotency keys and produce audit records. Destructive provider operations remain disabled until a dedicated approval flow is implemented and tested.
Application security
- HTTPS for public traffic and short-lived, passwordless login codes.
- Hashed one-time codes, database-backed rate limits, and 30-day sessions.
- Workspace-scoped authorization and append-only security or action records.
- Secret redaction and no raw provider tokens in ordinary application logs.
Report a vulnerability
Send a concise report to info@lidfly.ai with the subject “Security report”. Do not access data that is not yours, disrupt production, or include live credentials in email. Reports will be acknowledged and investigated in good faith.