How your data is protected
A plain description of the controls that actually exist, without the certification badges we have not earned.
Hosting and infrastructure
The platform runs on Microsoft Azure in the West US (United States) region. Application services, databases and secrets are held within a single Azure subscription under our control. All traffic between your browser and our services is encrypted in transit with TLS; data at rest is encrypted using the storage-level encryption provided by Azure SQL and Azure Storage.
Separate identities for clients and staff
Client sign-in and staff sign-in are handled by two entirely separate identity directories. A client credential cannot authenticate against a staff application and a staff credential cannot authenticate as a client, because they are issued by different authorities and validated against different audiences.
Staff access is further divided by role. Access to a given internal console requires an explicit role grant, and sensitive financial actions require a higher grade of role than reading the same records does — an approval and a review are held by different people by design.
Least privilege in the data layer
The application account that reaches our operational database holds read, write and execute permissions only. It is not a database owner, cannot alter schema, and cannot read object definitions. Services that face the public internet hold no database credentials at all — they call internal services, which are the only components with data access.
Payment card data
We do not store, process or transmit payment card numbers. Cards are tokenised in your browser by our payment processor, and only the resulting token reaches our systems. This means a compromise of our infrastructure does not expose card numbers, because they were never there.
Advertising platform credentials
Access tokens for Google, Meta and TikTok are stored encrypted, scoped to the minimum permissions each integration needs, and revoked when a client account closes. They are never exposed to browsers or included in client-side code.
Logging and audit
Administrative actions, campaign changes and access events are recorded with the identity that performed them. Access logs are retained for 12 months. Audit records exist so that a question about who changed what has an answer.
What we do not claim
We are not currently certified under SOC 2, ISO 27001 or PCI DSS as a service provider, and we do not display badges suggesting otherwise. Our payment processor maintains its own PCI DSS compliance for the card handling it performs on our behalf. If your procurement process requires formal attestations, contact security@mediapoint.ai and we will tell you exactly where we stand rather than imply more.
Reporting a vulnerability
Send details to security@mediapoint.ai. Please include enough information to reproduce the issue, and give us a reasonable opportunity to fix it before disclosing publicly.
We commit to:
- Acknowledging your report within two business days.
- Keeping you updated on remediation progress.
- Not pursuing legal action against researchers acting in good faith, who do not access data belonging to other people, degrade our service, or exfiltrate data.
If something goes wrong
If a security incident affects your personal data, we will notify you and the relevant supervisory authority in line with applicable law, and we will tell you what happened, what data was involved, and what we are doing about it. Our obligations here are set out in the Privacy Policy.