Security

We prioritize the security of your advertising and customer data. This document outlines our security architecture and practices.

Infrastructure & Hosting

Glimmio is hosted on Hostinger cloud infrastructure in Mumbai, India. Our deployment follows these practices:

• Network Isolation: PostgreSQL and Redis are bound to the internal Docker network and are not published to the public internet. A Caddy reverse proxy is the only entry point.
• TLS Termination: Caddy provisions and renews certificates automatically, and redirects all plaintext traffic to HTTPS.
• Host Firewall: Inbound access is restricted to HTTP, HTTPS, and SSH.

Data Encryption

• In Transit: All data transmitted between clients (browsers, APIs) and Glimmio is encrypted using TLS 1.3.
• At Rest: Data stored in our PostgreSQL database and on the encrypted asset volume is protected by full-disk encryption.
• Secrets Management: OAuth tokens, API keys, and other secrets are encrypted at the application level before being stored in the database, using AES-256-GCM with a key held only in the server environment.

Authentication & Authorization

• Channel connections: Meta, Google, and Shopify connect through their official OAuth or managed-install flows. Access tokens are encrypted before storage and never shown in the browser. We never ask for your password.
• RBAC: Role-Based Access Control ensures users can only access data and perform actions appropriate for their role (Owner, Admin, Manager, Media Buyer).
• Session Management: Sessions are managed securely using HTTP-only, secure cookies with strict SameSite policies.

Vulnerability Management

• Dependency Scanning: We use automated tools to scan for known vulnerabilities in our dependencies (npm audit, Dependabot).
• Container Scanning: Docker images are scanned for vulnerabilities before deployment.
• Responsible Disclosure: We welcome security researchers to report vulnerabilities to help@glimmio.com.

AI Providers & Data Sharing

AI features send the minimum context needed for a request to the provider selected for this deployment, currently OpenAI or Anthropic. Provider handling depends on the provider account and data controls in use. Glimmio does not promise zero retention or a specific provider agreement unless that commitment is documented for the deployed account. See our Privacy Policy and Subprocessors page for more information.

Compliance

Glimmio acts as a Data Processor under GDPR and a Service Provider under CCPA. Formal third-party attestation is not yet in place; the controls described on this page are the ones implemented in the product today, and the security contact below will answer questionnaires directly.