Security, Privacy & Compliance

    Clapp Technologies, LLC - Adle AI Whitepaper

    This document outlines the technical, organizational, and procedural controls Adle AI implements to safeguard customer accounts, campaign data, and any information our AI models process.

    1. Executive Summary

    Adle AI is a certified partner of Meta, TikTok, and Google. We operate a multi-tenant SaaS platform that creates and optimizes ad campaigns via AI agents. Security, privacy, and data isolation are foundational—every advertiser's data is segregated and never shared across accounts or competitors.

    2. Governance & Responsibility Matrix

    AreaPrimary OwnerOversight
    Security ProgramInterim CISOCEO & Board
    Privacy & ComplianceDPOLegal Counsel
    Infrastructure SecurityDevOps LeadEngineering VP
    Incident ResponseSecurity TeamCEO

    3. Account & Identity Protection

    3.1 Role-Based Access Control (RBAC)

    • Granular roles: Owner, Admin, Analyst, Viewer.
    • Least-privilege enforced by default; permission changes logged.

    3.2 Authentication

    • Email + Password (min 12 chars, breached-password checks).
    • Optional 2-Factor Authentication (2FA) via TOTP or WebAuthn.
    • Single Sign-On (SSO) with SAML 2.0 / OIDC for enterprise accounts.
    • Session tokens rotated every 12 hours, idle timeout 30 min.

    3.3 Business Account Integrations

    • OAuth scopes restricted to required permissions (Meta, TikTok, Google).
    • Each advertiser connected through dedicated service accounts / API tokens stored in an encrypted secrets manager.
    • No cross-client credentials; revocation supported at any time.

    4. Data Segregation & Isolation

    • Logical tenant IDs at database and object-storage layers.
    • Kubernetes namespaces and IAM roles enforce separation.
    • AI agents are instantiated per-advertiser, accessing only tenant-scoped data.

    5. Encryption & Key Management

    LayerMethodDetails
    In transitTLS 1.3 onlyHSTS + Perfect Forward Secrecy
    At restAES-256Managed KMS (AWS KMS)
    SecretsHashicorp VaultADR/rotation every 90 days

    Sensitive payloads (e.g., PII, access tokens) are additionally encrypted end-to-end when travelling between micro-services using mTLS.

    6. AI Data Handling & Privacy Controls

    • Training / fine-tuning uses anonymised & aggregated data—never raw creative, PII, or account IDs.
    • Guardrails: classifiers prevent prompt & response leakage of brand-specific metrics or creatives to other tenants.
    • Differential privacy noise added where aggregate insights are offered.
    • Human access to model logs is restricted and audited.

    7. Secure Development Lifecycle (SDLC)

    • Static & dynamic code analysis integrated in CI.
    • All pull requests require 2 reviewers.
    • Dependency scanning (Dependabot / Snyk) & supply-chain integrity (Sigstore).
    • Secrets detection in pipelines; any hit blocks merge.

    8. Infrastructure Security

    • Hosted on AWS us-east-1 & eu-west-1; multi-AZ high availability.
    • Private subnets, security groups, WAF, and least-privilege IAM.
    • Admin access via VPN + MFA + bastion; recorded via session manager.
    • Backups hourly (databases) & daily (object storage); 35-day retention; quarterly restore drills.
    • Disaster Recovery RPO ≤ 1 h / RTO ≤ 4 h.

    9. Monitoring, Logging & Incident Response

    • Centralised logs (CloudWatch + Loki) streamed to SIEM (Falcon LogScale).
    • 24×7 alerting on critical events; PagerDuty rotation.
    • Incident playbooks conforming to NIST 800-61.
    • Post-incident reviews shared with affected customers within 72 h.
    • Public bug-bounty via HackerOne (private program).

    10. Compliance & Certifications

    FrameworkStatusNotes
    GDPRCompliantDPA & SCCs available
    CCPA / CPRACompliantOpt-out & deletion APIs
    SOC 2 Type IIIn progressTarget Q1 2026 · External auditor: Strike Graph
    ISO 27001PlannedGap analysis complete

    We maintain a live Sub-processor List and execute DPAs with each vendor.

    11. Customer Controls & Responsibilities

    • User management UI & API for onboarding/offboarding.
    • Audit log export (JSON/CSV) available on demand.
    • Data portability: full export of campaigns & metrics at any time.
    • Data deletion SLA: ≤30 days after verified request.

    12. Business Continuity & Disaster Recovery

    • Weekly failover tests to secondary region.
    • Cold-start infrastructure scripts (Terraform) stored off-site.
    • Quarterly tabletop exercises.

    13. Vendor & Third-Party Risk Management

    • Security questionnaires & SOC 2 reports collected annually.
    • Automatic CVE monitoring for major dependencies.

    14. Frequently Asked Questions

    Q: How do you protect my Meta/TikTok/Google Business accounts?

    A: We use OAuth with the minimal scope, store tokens in an encrypted vault, isolate each advertiser in its own micro-service agent, and rotate credentials automatically.

    Q: Who can see my data?

    A: Only users you provision. Adle staff require documented, time-bound approval to access a tenant and all access is audited.

    Q: Can the AI leak my strategy to competitors?

    A: No. Models are fine-tuned per-tenant or on anonymised aggregates. Prompt-level guards prevent brand specifics from leaving your context.

    Q: Do you offer 2FA?

    A: Yes—TOTP or WebAuthn. Admins can enforce it organisation-wide.

    Q: Is my data encrypted end-to-end?

    A: Yes—TLS 1.3 in transit, AES-256 at rest, and optional end-to-end encryption for sensitive payloads.

    15. Contact & Reporting

    Security Team: [email protected]

    We commit to acknowledging any security report within 24 hours.

    © 2025 Clapp Technologies, LLC d/b/a Adle AI – All rights reserved.