1. Security Philosophy & Standards#
At Gineey, protecting agency client data, Meta OAuth access tokens, white-label client reports, and infrastructure integrity is fundamental to our product architecture.
Our security model is designed using enterprise security best practices (ISO/IEC 27001 & SOC 2 architectural principles), incorporating hardware-level token encryption, strict tenant isolation, and automated failover.
Gineey never sells client data, never stores plain-text Meta API credentials, and operates under strict multi-tenant isolation protocols.
2. AES-256 GCM Token Encryption#
Meta Graph API access tokens grant access to performance statistics and lead forms. To prevent token leakage, Gineey implements Galois/Counter Mode (GCM) AES-256 hardware encryption for every stored token.
Encryption in Transit
All web traffic, API payloads, and webhook ingestion routes enforce strict TLS 1.3 encryption with HSTS preload headers.
Encryption at Rest
Database columns holding access tokens are encrypted with unique AES-256 GCM keys stored in hardware key vaults.
3. Cryptographic Token Architecture#
Below is an overview of Gineey's multi-tenant token isolation pipeline:
Gineey Cryptographic Token Architecture
Hardware-Isolated OAuth Key Vault & End-to-End Encryption Diagram
Cloudflare WAF with DDoS mitigation, bot protection, and TLS 1.3 strict encryption.
Sub-2s concurrency pipeline with payload signature validation & rate limiting.
AES-256 GCM hardware encryption isolating Meta OAuth access tokens.
4. Role-Based Access Control (RBAC)#
Agency administrators can enforce granular Role-Based Access Control (RBAC) across team members and sub-accounts. Permissions dictate view and edit capabilities for campaign performance, white-label client reports, lead ingestion webhooks, and workspace billing.
Granular Team Roles
Define custom roles for Agency Admins, Account Managers, Performance Analysts, and Client Portal Guests.
Client Portal Isolation
Clients accessing white-label PDF portals view only assigned account metrics with zero Gineey platform references.
5. Cloud Infrastructure & 99.9% SLA#
Gineey is hosted on Tier-1 cloud infrastructure with multi-region redundancy, Cloudflare Web Application Firewall (WAF) threat filtering, and 24/7 uptime monitoring.
Tier-1 Hosting
Distributed node deployment ensures automatic failover, sub-2s lead ingestion, and low latency worldwide.
99.9% Uptime Commitment
Backed by real-time status monitoring and automated alert triggers for zero-downtime ad tracking.
6. Backups & Disaster Recovery#
Production databases undergo automated daily snapshots with 30-day point-in-time recovery (PITR). Disaster recovery protocols guarantee business continuity and rapid restoration in emergency events.
7. Audit Logs & Threat Monitoring#
Every critical action — including token authorizations, report exports, lead ingestion webhooks, and team member invitations — is logged to an immutable audit stream accessible to agency administrators.
8. Security & Trust FAQ#
Are my Meta access tokens safe if a server is compromised?
Yes. Access tokens are encrypted using hardware AES-256 GCM keys. The raw token is never exposed in plain text.
Does Gineey claim formal SOC 2 certification?
No. We do not claim formal SOC 2 certification. Instead, our system is engineered following enterprise security best practices and institutional data isolation frameworks.