Security at Lucreo

• In transit. All traffic to lucreo.io and to every provider API is encrypted with TLS 1.2 or higher. HTTP requests are redirected to HTTPS.
• At rest. The managed PostgreSQL database and its backups are encrypted at rest by our infrastructure provider.
• Application-layer token encryption. Google Ads refresh tokens and Shopify Admin API tokens are additionally encrypted with AES-256-GCM before they are written to the database, using a key held outside the database as a managed secret. A database dump alone cannot yield a usable token.
• Narrow decryption window. Tokens are decrypted in memory only, inside a server-side job, for the duration of a single API call. They are never sent to the browser and are redacted from logs and error messages.

• Row-level security on every table. Isolation is enforced by the database, not just by application code: a query can only reach rows belonging to workspaces the authenticated user is a member of, even if application logic were flawed.
• Security-definer helper functions resolve membership without recursive policy evaluation, so permission checks cannot be bypassed by crafted requests.
• Role-based access within a workspace: owner, admin and viewer, with destructive actions restricted to owners and admins.
• No anonymous data access. No table in Lucreo grants read access to unauthenticated requests.
• Least-privilege service credentials. Privileged keys exist only in server-side jobs and are never included in client bundles.

The strongest protection is not holding data at all. Lucreo therefore:

• stores no personal information about your customers — no names, emails, phone numbers, addresses, IPs or payment details;
• reduces orders to identifiers, dates, product references, quantities and monetary amounts;
• never receives or stores payment card data — Stripe handles that directly;
• requests only the API scopes required to read reporting data.

• Google Ads: read-only. Lucreo issues reporting queries only. It never creates, edits, pauses or deletes campaigns, ad groups, ads, keywords, bids, budgets or conversion settings, and never spends money on your behalf.
• Shopify: one explicit write. The only write Lucreo performs is setting a product to draft or active, and only for the products you select when you click that action. Prices, inventory, orders and customers are never modified.
• Revocable in one click. Disconnecting an integration deletes the stored token immediately; you can also revoke Lucreo at Google or uninstall the Shopify app.

• Every administrative action on a workspace is written to an append-only audit log.
• Background sync jobs report heartbeats; an independent watchdog fails and surfaces any job that stops reporting, so a silent failure cannot masquerade as success.
• Errors returned by Google or Shopify are captured verbatim and shown to you, not swallowed.
• Automated encrypted backups with point-in-time recovery are maintained by our database provider.
• Dependencies are scanned for known vulnerabilities and patched on a regular cadence.
• Changes are code-reviewed and deployed through an automated pipeline with rollback.

We investigate suspected incidents immediately, contain and remediate, and preserve evidence for review. If a personal data breach affects you, we notify the workspace owner by email without undue delay and in any event within 72 hours of becoming aware, describing what happened, the data involved, the likely impact and the steps taken — as committed in section 8 of our DPA.

Lucreo supports GDPR and UK GDPR obligations through our Data Processing Addendum, Standard Contractual Clauses for international transfers, a published subprocessor list with 30-day change notice, and documented retention and deletion timelines. Our use of Google APIs complies with the Google API Services User Data Policy, including Limited Use.

To be transparent about what we do not claim: Advance and Beyond LLC does not currently hold a SOC 2, ISO 27001 or PCI DSS certification of its own. The infrastructure providers we build on maintain their own independent certifications; we are happy to share the attestations available to us on request. We will publish any certification we obtain here rather than imply one we do not have.

• Use a strong, unique password, and enable two-factor authentication on your Google and Shopify accounts.
• Invite team members with the lowest role that lets them do their job, and remove members who leave.
• Disconnect integrations you no longer use.
• Tell us immediately at security@lucreo.io if you suspect unauthorised access to your workspace.

We welcome reports from security researchers. Email security@lucreo.io with steps to reproduce, affected endpoints and any proof of concept. We acknowledge reports within 3 business days and aim to provide a remediation plan within 30 days.

Please do, in good faith:

• test only against accounts and data you own;
• stop as soon as you confirm a vulnerability, and avoid accessing others' data;
• give us reasonable time to fix an issue before disclosing it publicly.

Please do not run denial-of-service tests, spam, social engineering or physical attacks.

We do not currently operate a paid bug bounty, but we credit researchers who report valid issues, and we will not pursue legal action against research conducted within these guidelines.