OAuth, no passwords
You sign in on Google’s, Meta’s or LinkedIn’s own screen and choose which accounts to connect.
Security & control
Security and control for your ad accounts and lead data
An AI that can change campaigns should be more transparent than a reporting tool, not less. Here is how Zephra connects, what it can change, who approves it, how lead data reaches the ad platforms, and how to switch it off.
The short version
Is it safe to connect Google Ads, Meta Ads and LinkedIn Ads to Zephra?
Short answer
Zephra connects to Google Ads, Meta Ads and LinkedIn Ads through each platform’s official API using OAuth, so it never sees your passwords. It makes changes only within the permissions and approvals your team sets, makes no campaign changes during the free assessment, and you can revoke access at any time from the platform.
Changes follow your rules
Low-risk changes can run automatically; everything else follows the permissions you grant or waits for approval.
Limits that bind the AI
Spend boundaries, cooldowns, learning-phase protection and safety stops apply to eligible actions.
Switch it off any time
Remove access from the ad platform directly. Your campaigns stay in your own accounts.
Access
What can Zephra access and change on each platform?
Zephra requests permission to read, write and edit campaigns. It reads account data to diagnose performance and, on a plan, carries out supported changes within your permissions. What any connection can do is also limited by the access level of the person who connects it.
| Platform | How it connects | What limits access | Lead stages sent (where configured) |
|---|---|---|---|
| Google Ads | Google Ads API via OAuth | Google uses a single authorisation scope for the Ads API, so the connecting user’s access level (Admin, Standard or Read-only) sets the ceiling. Access levels | Through Google’s Data Manager API |
| Meta Ads | Meta Marketing API via OAuth | The permissions granted at sign-in and the person’s role in the Business portfolio and ad account. Meta permissions | Through the Meta Conversions API |
| LinkedIn Ads | LinkedIn Marketing API via OAuth | The permissions granted at sign-in and the person’s role on the ad account in Campaign Manager. LinkedIn access | Through the LinkedIn Conversions API |
Can I connect Google Ads so Zephra can only view the account?
At the scope level, no Google Ads connection is read-only, because Google’s Ads API has one scope for every app. What limits any app is the access level of the Google Ads user who connects. Zephra makes no campaign changes during the assessment; for supported actions on a plan, the connecting user needs an access level that allows changes, and your approvals and spend limits then govern what runs.
Free assessment
What happens during the free assessment?
- Zephra reads and analyses ad-account data to find wasted spend, structural problems, performance constraints and measurement gaps.
- No campaign changes are made. Nothing in your accounts is edited, paused or launched.
- No CRM is required, so no lead or customer data needs to be shared to start.
- It takes 10–15 minutes, and you can revoke access afterwards if you don’t continue.
Controls
Who approves changes, and what limits apply?
Your team decides
Choose which kinds of change can run automatically and which always need a person’s approval.
Limits on money
Budget changes stay within the limits you set. Ad spend is billed by the platforms, not by Zephra.
Time between changes
Repeated edits are spaced out, and eligible changes wait while campaigns are learning.
Stop when something looks wrong
Guardrails halt eligible automated actions when results or spend move outside expected bounds.
Every change recorded
Each change Zephra makes is logged, so your team can see what changed, when and why. Changes aren’t rolled back automatically; tell Zephra in chat what should be done instead.
Lead data
How are lead data and conversions sent to ad platforms?
Where configured, Zephra sends CRM lead stages (such as qualified, opportunity or won) to Google through the Data Manager API, and to Meta and LinkedIn through their Conversions APIs, so the platforms can measure and optimise on outcomes that matter.
- Hashed contact details. The platforms require email addresses and phone numbers to be normalised and SHA-256 hashed before they are sent.
- Click identifiers. Click IDs captured with the lead let platforms match an outcome to the original ad interaction.
- Your lawful basis. You remain responsible for having consent or another lawful basis for the lead data you send. Hashed data is still personal data under most privacy laws.
Details of the data Zephra processes are in the privacy policy; the third parties involved are on the sub-processor list. For how tracking works end to end, see conversion tracking.
Regulation
How does Zephra handle GDPR, India’s DPDP Act and the UAE PDPL?
Zephra’s standard data processing agreement is part of its terms on every plan and takes effect when an account is created, with EU Standard Contractual Clauses and UK transfer safeguards where they apply. Custom or negotiated terms are handled case by case. Zephra also supports customers’ obligations with a published sub-processor list with advance notice of changes, and deletion on request. We don’t display compliance badges; ask for the documentation your review needs.
DPDP Act 2023
The DPDP Rules were notified in November 2025 and phase in through May 2027. For lead data you send through Zephra, you decide the purpose and Zephra processes it on your behalf.
PDPL
Federal Decree-Law 45 of 2021 applies outside DIFC and ADGM, which have their own data protection regimes. Tell us early if your data must stay within a particular regime.
GDPR and state laws
The terms include a data processing agreement, and sub-processors are listed with 14 days’ notice before new ones are added. US state privacy laws are covered in the privacy policy.
Offboarding
How do I revoke access or delete data?
| To… | Do this |
|---|---|
| Revoke Google Ads access | Google Account → Security → Third-party apps and services; or remove the connected user under Admin → Access and security in Google Ads. |
| Revoke Meta Ads access | Business settings → Integrations → Connected apps; or Facebook Settings → Business integrations. |
| Revoke LinkedIn Ads access | LinkedIn Settings & Privacy → Data privacy → Permitted services; or remove the user from the ad account in Campaign Manager. |
| Delete your Zephra account and data | Email hello@zephraai.com from the account owner’s address. Retention of backups and legally required records follows the privacy policy. |
Revoking access stops Zephra’s API access. Your campaigns keep running in your own accounts under your control.
For IT and procurement
Security review for mid-market and enterprise teams
If your organisation reviews vendors before they connect to ad accounts or receive lead data, start with a demo rather than the self-serve assessment. Bring your questionnaire; we will walk through access, approvals, data flows and sub-processors with your team, and share the documents the review needs.
Security questions and vulnerability reports: hello@zephraai.com.
Questions, answered
Security FAQ
01Does Zephra ever change campaigns without approval?
Only changes your team has allowed to run automatically, and only within your spend boundaries and guardrails. Low-risk changes can run automatically; everything else follows the permissions you grant or waits for approval. The free assessment makes no changes at all.
02Can Zephra spend more than my budget?
Budget changes stay within the spend boundaries you set, and larger moves can require approval. Ad spend is billed to you by Google, Meta and LinkedIn; Zephra does not hold or pay your ad spend.
03Does Zephra store my ad platform password?
No. You connect through each platform’s OAuth sign-in, so Zephra receives an access token, never your password. Token handling is described in the privacy policy.
04Is my data used to train AI models for other customers?
According to the privacy policy, your identifiable campaign data is not used to train models shared with other customers. Anonymised, aggregated data may be used for system improvement as the policy describes.
05Can I limit what Zephra can do in Google Ads?
Google’s Ads API uses one scope for all apps, so what a connection can do depends on the Google Ads access level of the user who connects. A Read-only user cannot make changes. For supported actions on a plan, the connecting user needs Standard or Admin access, and your approvals and spend limits then apply.
06Can Zephra undo a change it made?
Changes are not rolled back automatically. Every change Zephra makes is recorded in an audit log, so you can see what changed and when, and you can tell Zephra in chat what should be done instead. That request then follows your permissions and approvals like any other change.
06Do you hold SOC 2 or ISO 27001 certification?
We don’t advertise a SOC 2 or ISO 27001 certification on this site. If your review requires either, raise it at the start of a demo so we can tell you what documentation is available.
07What happens if I disconnect Zephra?
Zephra’s API access stops. Your campaigns stay in your own ad accounts and keep running under your control. You can also request deletion of your Zephra account and associated data.
08Who is responsible for consent for the leads we send?
You are. Your business collects the leads and decides how they are used, so your forms and notices need to cover sending hashed lead data to ad platforms for measurement. Zephra processes that data on your behalf under the data processing terms.
Start safely
See what Zephra finds, without it changing anything.
The free assessment reads and analyses your ad accounts and makes no campaign changes. Revoke access afterwards if you choose.
- OAuth sign-in
- No campaign changes during assessment
- Revocable at any time