Skip to main content

​
Security

Connecting an advertising account requires trust. This page summarizes what AdCue accesses, how credentials are stored, and how you stay in control.

​
Principles

​
Authentication layers

​
Website login (Auth0)

  • Sign-in uses Auth0 Universal Login.
  • AdCue requires a stable subject, email, and verified email.
  • The browser does not receive raw Auth0 access tokens for casual inspection; the server binds the session to an internal user.
  • Initiated from Connections via AdCue’s Ads connect routes.
  • Scope: https://www.googleapis.com/auth/adwords
  • Does not grant Gmail, Drive, Calendar, or unrelated Google APIs.
  • Stored refresh tokens are encrypted and used only for Ads API calls on your behalf.

​
MCP client access

  • Remote MCP at https://mcp.adcue.app/mcp
  • Clients authenticate as your AdCue user (OAuth and/or API keys depending on product path)
  • The MCP server injects tenant identity; clients should not pass raw multi-tenant credentials

​
MCP safety (product rules)

See the full Safety model. Highlights:
  • Creates land PAUSED
  • Destructive remove_* requires confirm_delete: true
  • customer_id is always a string

​
What we store (product data)

Exact retention for analytics features may evolve; account deletion remains the hard stop for product-owned user rows.

​
Infrastructure (high level)

​
Account deletion

From Settings, permanent delete:
  • Removes the AdCue user and cascaded product rows (connections, MCP entitlements owned by that user, plans, related app state)
  • Best-effort revokes the stored Google Ads refresh token
  • Ends the website session
  • Does not delete Auth0 tenant identities via Management API, and does not remove independent waitlist signups
Signing in again creates a new user and onboarding path.

​
Reporting security issues

Email support@adcue.app with subject Security Report. Please allow reasonable time for investigation before public disclosure. Do not include live tokens or private keys in the report body if a redacted reproduction is possible.