Security
How Roster handles your data
Updated 2 November 2026
Roster reads what it needs to build your reports, changes an account only to create a campaign you approved, and never sells your data or uses it for advertising.
This page is the plain version. The privacy policy has every detail, and it is the one that counts.
What Roster can see
- In Google Ads: account and campaign names and IDs, and performance figures such as spend, impressions, clicks and conversions. Also the email address of the Google login you connect with, so you can tell which one a workspace uses.
- In Meta: the ad accounts your login can reach, and for the ones you choose, campaign names and performance figures. These are totals for an ad account; none of them identifies a person who saw an ad.
- Pages and Instagram accounts: only their names and IDs, so ads run as the right one. Roster does not read their posts, messages, followers or insights.
What Roster changes
One kind of change: a new campaign (or, in Google Ads, a conversion action) that you asked for and approved in exactly that form. Google or Meta checks it first without creating anything, and it is created paused, so nothing runs or spends until you switch it on.
Roster never edits, pauses, removes or switches on anything else in your accounts, Pages, Instagram accounts or business portfolios.
The permissions it asks for
| Permission | What Roster uses it for |
|---|---|
Google Ads (adwords) | Reading report figures, and creating the campaigns and conversion actions you approve. Google classes this scope as sensitive because it permits changes; Roster makes only the one kind above. |
Meta ads_read | Reading the performance of the ad accounts you choose. |
Meta business_management | Finding the ad accounts in your business portfolios so you can choose among them. Roster only reads it. |
Meta ads_management | Creating the campaigns you approve, and seeing which Instagram accounts an ad account's ads can run as. |
Meta pages_show_list, pages_read_engagement | Seeing which Facebook Pages an ad account can advertise as. |
Where it's kept, and how
- The application runs on Google Cloud in Singapore, and the database is hosted by Neon.
- Google and Meta access tokens are encrypted at rest with AES-256-GCM.
- Passwords are stored only as salted hashes; nobody, including us, can read them.
- Session cookies can't be read by page scripts, are never used for measurement, and are cancelled on our side when you sign out.
- Every agency's data is walled off in the database query itself, so a mistaken link or ID returns nothing rather than someone else's records.
- Everything travels over HTTPS.
What Claude sees
When you design a report with Claude, the report definition and the account structure it is based on are processed by Anthropic, under its own terms. No Google or Meta token is ever sent to Anthropic.
What Roster never does
- It never sells your data or your clients' data.
- It never uses it for advertising, or to build profiles of people.
- It never uses it to train machine learning models.
- Nobody reads it, except when you ask us to for support, when security or the law requires it, or when it has been aggregated so it identifies no one.
Roster's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Links you send to clients
A share link is read-only and keeps the figures as they were when you made it. It needs no login, so anyone who has it can see that report: treat it like the report itself. You can revoke a link from the report page at any time.
Leaving, and taking your data with you
- Disconnect Google or Meta inside Roster and the stored token is deleted.
- You can also revoke Roster from your Google account's permissions page, or from Business integrations in your Facebook settings.
- Delete a report or a client inside Roster, and its figures go with it.
- To delete your whole account, email us from the address you sign in with. We delete it within 30 days and write back to confirm, keeping only what the law requires.
Found a problem?
If you think you have found a security problem, write to us before telling anyone else, and we'll reply quickly.