Trust & Security

How we protect your business and customer data.

Growth checks across your accounts

Budget, bidding, creative, audience and wasted spend

Checks Glimmio can apply for you

The rest are advisory, drafted for review, or guided step by step

7 days

Rollback window on supported changes

Eligible changes save the previous settings and re-check the platform before rolling back

Permission controls

Across 13 roles, scoped per client account

Security controls

Access controls, audit trails, signed callbacks, and per-customer authorization protect everything you do in your workspace.

Encryption

All traffic uses HTTPS. Credentials for connected platforms are encrypted before storage with authenticated encryption.

Private service network

Application services, PostgreSQL, and Redis remain on a private network behind the HTTPS proxy.

Data minimization

Glimmio processes only the data needed for enabled features and publishes its subprocessors and deletion process.

Before you connect an account

Security is half of trust. The other half is knowing exactly what the platform will and will not do with your ad spend.

Can it change my campaigns without me?: No. Nothing runs unattended. Every recommendation waits for your approval, and new campaigns and ads are always created paused so spend never starts by accident.
Is every recommendation one click to apply?: No, and the difference is labelled before you approve. 57 of the 66 checks can be written straight to the provider. The others are advisory, drafted for you to review inside Meta or Google, or guided step by step — because some changes should not be automated.
What if a change makes things worse?: Eligible actions preserve the previous state before the write and can be rolled back for 7 days, provided the provider state still matches. Advisory and non-reversible actions are labelled as such before approval.
How do I know the numbers are real?: Every figure comes from Meta's, Google's and Shopify's own APIs, labelled with which platform reported it and when it was last synced. Where the platforms disagree — and they do — Glimmio shows you the gap instead of blending it into one flattering number.
Will it invent work to look busy?: It will tell you when there is nothing to do. Recommendations only appear once there is enough spend and enough confidence to stand behind them. A quiet week is an honest answer.
Do I need to install a tracking pixel?: Not for Meta Pixel, Conversions API or Google Tag health checks — Glimmio reads the provider diagnostics you already have. If you enable Shopify storefront analytics or lifecycle automation, Glimmio installs its consent-aware Shopify Web Pixel after merchant authorization; no theme code needs to be pasted.
Who can see and approve what?: 48 permissions across 13 roles, scoped per client account, with an audit trail of who approved what. Built for agencies running several brands from one login.

Authentication & Authorization

Glimmio uses each platform's official connection flow: OAuth for Meta, Google, and Shopify. We never receive your password, and every access token is encrypted at rest.

Within Glimmio, role-based access control (RBAC) ensures users only have access to authorized workspaces and features. Critical features, like executing campaigns, require explicit Manager or Admin level permissions.

Vulnerability Management

We run continuous automated dependency scanning and security audits on our infrastructure. We also partner with external security researchers to maintain a proactive security posture.

If you believe you have found a security vulnerability in Glimmio, please email help@glimmio.com. We take all reports seriously.

Compliance & Privacy

Glimmio acts as a Data Processor under standard global data privacy frameworks (such as GDPR). We process data strictly to provide and improve the Glimmio service.