Security
What we do with your access,and what is still on the list.
Plain language, no badges. Ripple runs ads with your money, so most of the engineering exists to make sure a bug cannot cost you real money or leak one customer's data to another. The last section is the part most security pages leave out.
Last updated 2026-09-15
Watching. Not touching.Your platform credentials
- You sign in to Meta and Google yourself, through OAuth. Ripple never sees your password.
- The access and refresh tokens Meta and Google issue are encrypted with AES-256-GCM envelope encryption before they are stored; the ciphertext, the encrypted data key and the key version are kept apart from the wrapping key.
- Those tokens are used server-side only. They are never sent to an MCP client, to a model provider, or to the browser.
- Revoking Ripple in your Facebook or Google settings invalidates them immediately.
Workspaces are isolated
- Every record belongs to one workspace. Database access goes through a layer that refuses any query not scoped to a workspace and rejects a write that crosses one.
- Child records reference their parent and their workspace together, so a record cannot point at another workspace’s data.
- Tests run cross-workspace reads and writes against a real PostgreSQL to prove the refusal.
Money-moving actions
- One code path may change a live campaign. A lint rule fails the build if any other file calls a platform write.
- Before every write that path re-reads your daily, weekly and monthly ceilings, per-change limits, protected campaigns, the emergency stop and your subscription — and refuses if any fail.
- Creating a write-capable MCP token, raising a ceiling or switching an account to live asks for your authenticator again if it has been more than fifteen minutes.
- The emergency stop is deliberately not behind any of that; a kill switch that can fail closed on a validation error is not a kill switch.
Sign-in and sessions
- Passwords are bcrypt-hashed. Sessions rotate; refresh tokens are single-family with a short reuse grace for browsers that restore many tabs at once.
- Authenticator (TOTP) multi-factor is available and required for live-spend controls.
- Sign-in attempts are rate-limited with a progressive lockout.
Logging and audit
- Every change carries who asked (a person, an agent, or a named MCP token), what changed, the previous value, the reason and the guardrail verdict.
- Audit and spend-authorisation tables have database triggers that reject updates and deletes.
- Application logs redact credentials, authorisation headers, provider key formats, email addresses and token-like query strings.
Web
- A per-request Content-Security-Policy nonce on scripts, HSTS, nosniff, referrer and permissions policies.
- Stripe webhooks are verified on the raw body before parsing and replay-protected.
- The MCP endpoint reads its token from the Authorization header only — never from the URL — and rate-limits per token.
Retention and deletion
- MCP call logs are pruned after 30 days. Synced performance data stays for as long as the workspace exists.
- Ask us to delete your workspace by email — the data-deletion page has the steps. Deletion removes connections, tokens and synced data; revoking Ripple in Facebook or Google stops access on its own but does not delete the copy Ripple holds.
Still open
What is not done yet.
- The key that wraps stored platform tokens is managed as an environment secret, not by a cloud KMS. KMS-backed key management and a rehearsed rotation are on the list before Ripple is offered to paying customers at scale.
- There is no MFA recovery path. Losing your authenticator with MFA on means contacting us.
- No third-party penetration test has been completed yet.
- Ripple does not hold a SOC 2 report and does not claim one.
Report a problem.
If you believe you have found a security issue, email info@goripple.team with “security” in the subject. We will acknowledge within two business days and will not take action against good-faith research. See also the privacy policy and the trust page.