Found a security problem? Tell us.

Use the contact form and choose “Reporting a security issue” — you’ll get a case reference straight away — or email accounts@adcquire.com with “Security” in the subject.

• What you found, where (the page or address), and the steps to see it again.
• What you think someone could do with it.
• How we can reach you.

This includes any suspected misuse of Amazon Ads data held in Adcquire, and privacy concerns (see the privacy notice).

Please don’t send passwords, keys, tokens or anyone else’s data. If you need to share something sensitive, say so and we’ll agree a safer way to receive it.

1. A person reads every report. We aim to acknowledge it within two working days, quoting your reference.
2. We look into it and tell you whether we can reproduce it.
3. If it’s real, we fix it and tell you when it’s fixed. If it isn’t, we explain why.
4. Please give us reasonable time to fix a problem before telling anyone else about it.

If you look for problems in good faith and follow this page, we treat your research as authorised by us, won’t take legal action against you for it and won’t report it to the police. Following this page means:

• test only your own account and data;
• stop as soon as you’ve confirmed an issue;
• don’t access, change or keep anyone else’s data;
• don’t disrupt the service, for example with denial of service, spam or social engineering;
• give us reasonable time to fix it before telling others.

This covers Adcquire only. We can’t authorise testing of Amazon’s or anyone else’s systems.

• All traffic between your browser and Adcquire is encrypted with HTTPS (TLS).
• Passwords are stored only as one-way hashes; sign-in is rate-limited.
• Optional two-step verification with an authenticator app, and one-time recovery codes, on your Account page.
• Sessions end 12 hours after you last use them, in a cookie that scripts can’t read, with protection against requests forged by other websites.
• Every brand is its own workspace: people see only the brands they belong to, with owner, editor and viewer roles. Automated tests check that one brand can’t read or export another’s data.
• If you connect Amazon (once that’s available), its access token is encrypted at rest and never sent to your browser.
• Error records are scrubbed of email addresses and tokens.
• No advertising or analytics trackers run on the site or in the dashboard.
• Nothing reaches your Amazon ads until a person on your team presses Send. An automatic rule approves its change for you; a person still presses Send. Every change is logged with who made it.

Not available yet: passkeys and single sign-on. Adcquire holds no security certification (such as SOC 2 or ISO 27001).

Ovnit LTD, which operates Adcquire. See company details and how we handle personal data in the privacy notice.