Security at Hyperscaler
Effective date: 3 November 2026
1. How we protect your data
- Encryption in transit: all traffic uses HTTPS/TLS.
- Encryption at rest: Meta, Google and other integration access tokens are encrypted with AES-256-GCM using rotating keys, before they are stored. Passwords are stored only as salted one-way hashes. Databases and file storage are encrypted by our infrastructure providers.
- Payments: card data is handled by Braintree (PayPal), which is PCI DSS compliant. Hyperscaler never stores full card numbers.
- Least privilege: we request only the permissions needed for the features you use. Staff access to production systems is limited to those who need it and is logged.
- Isolation: each organisation's data is separated, and access is checked on every request.
- Safe changes: we only create or change ads in your accounts through the platform's official APIs, following your approval and automation settings.
- Monitoring and reliability: we log security-relevant events, monitor the service, rate-limit abusive traffic, keep backups, and test recovery.
- Secure development: code review, automated checks and dependency updates before release.
2. Your part
- Use a strong, unique password.
- Only invite team members who need access, and remove them when they leave.
- Review the permissions you grant on the Meta and Google consent screens.
- You can disconnect any integration at any time; we delete the stored token immediately.
3. Incident response
If we find a security incident affecting your data we will contain it, investigate, and notify affected customers and authorities without undue delay and as the law requires.
4. Reporting a vulnerability
Email hello@hyperscalerai.co with details. Please give us reasonable time to fix the issue before disclosing it publicly, and do not access other users' data or disrupt the service. We will acknowledge within 3 business days.
5. Compliance
We design the service to meet the requirements of the Meta Platform Terms, the Google API Services User Data Policy, and applicable data protection laws.