Trust Center
Security and compliance, stated honestly
What Bielby Group AI accesses, how access is controlled, what is logged, who else is involved — and which controls are implemented, in progress, or still planned. No claimed certifications. Current as of September 2026.
// Control framework
Ten areas. Every control with an honest status.
Security
Protection of credentials, sessions, and platform access.
Encryption in transit
All traffic between browsers, Bielby Group AI services, and connected network APIs is served over TLS. Plain-HTTP endpoints are not exposed.
Encryption at rest
Stored application data and network access tokens are encrypted at rest using the managed database and platform key management.
Secrets management
Network tokens, API keys, and webhook secrets are stored as server-side secrets, never shipped to client bundles, and are rotatable without code changes.
Penetration testing
Independent third-party penetration testing is planned before broad enterprise availability. No external test report exists today.
Privacy
How advertiser and personal data is collected, limited, and removed.
Data minimization
Verification collects the business attributes needed to establish identity and policy eligibility — not general personal data. Consumer audience data is not ingested.
Retention
Verification evidence and audit records are retained while an advertiser account is active. Formal per-category retention schedules are being finalized.
Deletion
Advertisers can request workspace deletion. Identity evidence, connections, and campaign records are removed or anonymized, subject to dispute and legal holds.
Privacy policy & DPA
A public privacy policy exists. A standard data processing addendum for platform customers is in legal review.
Access
Who can act inside a workspace, and how that is enforced.
Multi-factor authentication
MFA is available for all workspace members and required for roles that can approve submissions or manage connections.
Role-based access control
Owner, operator, analyst, and viewer roles with scoped permissions. Agency and platform roles are scoped per client or customer.
SSO (SAML / OIDC)
Single sign-on for enterprise workspaces is in development. Today, authentication uses email and supported OAuth providers.
SCIM provisioning
Directory-based provisioning and deprovisioning is on the roadmap alongside enterprise SSO.
Scoped API keys
Platform API keys carry explicit scopes per object type, can be rotated, and are attributable in the audit log.
Data
How advertising and identity data is classified and handled.
Data classification
Identity evidence, network credentials, campaign data, and performance metrics are classified separately with distinct handling rules.
Network credential handling
Advertising network tokens are write-scoped where networks allow, stored encrypted, and never displayed after initial connection.
Sub-processor register
A public list of verification providers, hosting, and analytics processors is being published alongside the DPA.
Application
Security of the Bielby Group AI product itself.
Audit logging
Every material action records actor, role, advertiser, workspace, previous state, decision, and resulting state. Logs are immutable and reviewable in-product.
Environment separation
Development, preview, and production environments are separated with independent credentials and data.
Secure development review
Changes to verification, Preflight, and submission paths receive peer review. A formal SDLC policy document is being finalized.
Dependency scanning
Application dependencies are scanned for known vulnerabilities as part of the build pipeline.
Infrastructure
Hosting, isolation, and monitoring of the platform itself.
Managed cloud hosting
Bielby Group AI runs on managed cloud infrastructure with network isolation and managed database services; there are no self-managed servers.
Availability monitoring
Platform availability and API health are monitored continuously. Advertising infrastructure health is surfaced per network in the product.
Status page
A public status page for Bielby Group AI platform availability is planned. Advertising infrastructure incidents are currently visible inside the product.
Operations
How the team runs the platform day to day.
Incident response
A documented incident process covers detection, severity classification, ownership, customer notification, and post-incident review — the same lifecycle shown in the demo.
Access reviews
Internal access to production systems is least-privilege. Quarterly formal access reviews are being established.
Change management
All production changes ship through version control with review and automated checks before deployment.
Vendors
Third parties involved in delivering Bielby Group AI.
Vendor review
Verification providers, hosting, and analytics vendors are assessed before adoption. A formal recurring review cadence is being established.
Network relationships
Bielby Group AI connects to advertising networks through their official APIs and partner programs, under each network's own terms. Bielby Group AI is an independent technology layer, not affiliated with or endorsed by any network.
Business continuity
Resilience of data and service.
Backups
Database backups are automated by the managed platform with point-in-time recovery capability.
Recovery testing
Documented recovery objectives and scheduled restore testing are planned as the customer base grows.
Business continuity plan
A continuity plan covering provider failure and key-person risk is in draft.
Compliance
External assurance programs and their honest status.
SOC 2 Type II
Bielby Group AI does not currently hold a SOC 2 report. Control design aligned to SOC 2 criteria is underway.
ISO 27001
No ISO 27001 certification is held today. It is on the assurance roadmap.
GDPR alignment
Data subject request handling, minimization, and deletion workflows exist. A formal records-of-processing document is being completed.
HIPAA / PCI
Bielby Group AI does not process protected health information or cardholder data. Advertising payment relationships remain with the networks.
// Data flow
Where advertiser data goes — and where it doesn't
Verification providers · Advertising networks · Analytics systems
Verification providers
Sent by Bielby Group AI during verificationBusiness registration details, domain ownership evidence, and representative identity attributes — sent only to confirm the advertiser is a real, identifiable business.
Advertising networks
Two-way, per advertiser connectionCampaign configuration, creative, and copy submitted through official network APIs after passing Bielby Group AI Preflight; account and policy status received back.
Analytics systems
Internal, operational onlyOperational events (errors, latency, feature usage) used to run and secure the platform. Advertiser identity evidence is not sent to analytics systems.
What Bielby Group AI never receives
Consumer audience lists, advertising payment card details, and network account passwords. Connections use official OAuth or scoped API tokens; payment relationships stay between the advertiser and the network.
// AI governance
AI recommends. Humans decide. Everything is logged.
What AI can recommend
Remediation for failed campaign checks (copy, creative, destination), operational next steps, budget and pacing suggestions, and diagnostic summaries for infrastructure incidents. Every recommendation carries the evidence it is based on.
What AI can execute
Drafting changes inside a review state and re-running automated checks. AI never submits a campaign, changes a live budget, modifies connections, or alters verification status on its own.
Human approval
Submitting any campaign to a network requires a named human approval step after Preflight passes. Applying an AI remediation is itself an explicit, attributed human action.
Evidence
Each recommendation links to the exact finding, policy excerpt, or diagnostic signal that triggered it. Recommendations without traceable evidence are not shown.
Logging
AI suggestions, the human decision on each, and the resulting state changes are all written to the audit log with actor and timestamp.
Data handling
AI features operate on the advertiser's own campaign, compliance, and infrastructure data. Advertiser data is not used to train models for other customers.
Model limitations
AI recommendations can be wrong about policy interpretation. They are advisory; the network's own review is authoritative and human reviewers remain responsible for submissions.
Advertising networks keep their authority
Advertising networks retain their own approval, enforcement, policy, and account authority. Bielby Group AI screens campaigns before submission and records network decisions afterward — Bielby Group AI does not guarantee network approval, does not act on behalf of any network, and is not affiliated with or endorsed by Meta, Google, or TikTok.
Security review in progress?
Talk to us about access control, data handling, AI governance, and the assurance roadmap — or explore the simulated audit trail in the live demo.