Security and privacy at PaidHelm

Giving a tool access to your advertising account is a serious decision. This page explains exactly what PaidHelm can and cannot do, what we store, and how to turn it off.

Authorization

• Google OAuth 2.0. You never type your Google password into PaidHelm. Google's consent screen asks you to grant the Google Ads scope and returns a token to us.
• Single scope. We request only https://www.googleapis.com/auth/adwords, plus your email address to identify your account. No Gmail, Drive or Analytics access.
• Encrypted at rest. Refresh tokens are encrypted with a key held only in the Worker's secret store before being written to the database.
• Revocable. You can revoke at any moment from Google or from the PaidHelm portal. Revocation takes effect immediately.

What the assistant can do

Exactly what the Google Ads API allows the authorizing user to do, filtered through PaidHelm's tool definitions. In practice:

• Read any report (GAQL), list accounts, run the keyword planner.
• Create campaigns, ad groups, ads, keywords, negatives, extensions and targeting. All new campaigns are created paused.
• Pause, enable, rename, change budgets and bid strategies for objects identified by ID.
• Remove objects only when explicitly asked and with the exact identifier.

PaidHelm cannot change billing, invite users, link or unlink manager accounts, or touch any Google product other than Google Ads.

Data we keep

We do not store report results, campaign contents or the text of your conversations. Your conversation lives with your AI provider under their terms.

Infrastructure

• Runs on Cloudflare Workers with D1 (SQLite) and KV, in Cloudflare's SOC 2 Type II audited environment.
• All connections use TLS 1.2+; the MCP endpoint is only reachable over HTTPS.
• Secrets (encryption key, API keys, admin credentials) live in Cloudflare's encrypted secret store and are never committed to source code.
• Payments are handled by Paddle; PaidHelm never sees card numbers.

Compliance

• PaidHelm complies with the Google Ads API Terms and Google's API Services User Data Policy, including Limited Use requirements.
• We honor GDPR and CCPA data-subject rights (access, correction, deletion, portability). Write to [email protected].
• A Data Processing Addendum is available for customers who need one.

Reporting a vulnerability

Email [email protected] with "Security report" in the subject. We acknowledge within two business days and will credit researchers who report responsibly.