Runs in your cloud
AWS, GCP or Azure, under access you grant and can revoke.
- Home
- Security
Security
Your data, your cloud, your rules.
Your ad data stays in a cloud account you own. We work inside it under access you grant, log what we change, and leave when you say so.
What you get
You stay in control of your data.
Named people only
Access through your SSO or cloud IAM, removed when the work ends.
Read-only by default
Ad data is pulled read-only. Write access, such as AMC audience uploads or agent bid changes, is a separate opt-in permission with caps, approvals and rollback.
Every agent change logged
Before and after recorded, and every change can be rolled back.
How we handle access
Built so you stay in control.
Your account, your region
Pipelines, warehouse and agents run in your AWS, GCP or Azure account, under access you grant and can revoke.
Least-privilege API access
We use each ad platform's own API permissions, scoped to the accounts in the engagement.
Credentials stay with you
Secrets live in your secrets manager, not in spreadsheets or email.
NDA before discovery, DPA before data
Signed before we see anything.
People and locations
Who can touch your data, and from where.
Access through your SSO
Only the engineers named on your engagement get access, through your own SSO or cloud IAM roles. Access is removed when the work ends.
Where our engineers are
Lahore, Sharjah, Bengaluru and Surrey, BC. Your data stays stored in the cloud region you chose; engineers reach it remotely, under your access controls.
Agent writes are opt-in
Pipelines read from ad platforms. Write access for AI agents is a separate permission with caps, approval queues and rollback, and every change is logged with the before and after.
Leaving is easy
Code, docs and runbooks live in your repo. Revoke our access and everything keeps running in your account.
Privacy by region
Built for US, Canadian, UK, EU and UAE buyers.
GDPR and UK GDPR
We act as your processor under a DPA, and your data stays stored in the EU or UK region of your own cloud. Remote access from outside the UK and EU is a restricted transfer, so the DPA covers it with the EU standard contractual clauses and the UK addendum.
Canada (PIPEDA)
Your warehouse can sit in a Canadian region of AWS, Google Cloud or Azure. We work inside it rather than copying data out.
US and UAE
Same model: your account, your region, your access policies. We sign your NDA before discovery and a DPA before any data access.
Your security review
Send your security questionnaire before kickoff and an engineer completes it. We work under your policies, not ours.
Trust center
Policies and practices.
Application security
We review our own code before release and work inside your security policies and tooling.
Sub-processors
Depending on engagement scope, we may use cloud infrastructure providers (AWS, Azure, GCP), communication tools, and development platforms. A full sub-processor list is available on request during procurement.
NDA & DPA
We sign an NDA before discovery and a DPA before any data access. To start either, email hello@techesthete.com with your company name and procurement contact.
Need our security questionnaire answered?
Send it over. A senior engineer will answer it.