Built to look, never to touch.
Sherlock is designed around one promise: it can read your numbers, and it can never change your campaigns.
Last updated: September 21, 2026
Read-only by design
Sherlock requests only read permissions from Meta, Google and TikTok. The platforms themselves prevent Sherlock from creating, editing, pausing or deleting anything in your advertising accounts.
How your data is protected
- Encrypted connections. All traffic uses HTTPS.
- Encrypted tokens. Access tokens for advertising platforms and Slack are encrypted at rest, with the encryption key held outside the database. Tokens never appear in logs, the browser or monitoring tools.
- Tenant isolation. Every record belongs to one customer, and isolation is enforced by the database itself, not only by application code. Automated tests check that one customer can never read another’s data.
- Roles. Owner, Admin, Editor and Viewer roles limit who can change targets, rules, people and billing. Agencies can limit staff to specific brands.
- Audit trail. Changes to rules, targets, people and connections are recorded.
- Separate environments. Development, staging and production use separate systems and credentials.
How alerts are decided
Whether a guardrail has been breached is calculated by fixed, testable code from the figures your advertising platforms report. AI is used only to read rules you write in plain English and to add optional commentary, and it never receives access tokens.
Availability and backups
The database is backed up daily and restores are tested. An independent monitor alerts us if scheduled checks stop running.
Service providers (subprocessors)
These companies process data on our behalf. We will update this list before adding a new one.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting for the website and app | United States |
| Supabase | Database and sign-in | United States |
| Trigger.dev | Scheduled checks and background jobs | United States / EU |
| Stripe | Payments and invoicing | United States |
| Postmark | Account and billing emails | United States |
| Sentry | Error monitoring | United States |
| Anthropic | Reading plain-English rules and writing digest commentary | United States |
Meta, Google, TikTok and Slack are the platforms you connect. They act under their own terms with you, not as our subprocessors.
Report a vulnerability
If you believe you have found a security issue, email andrew@igloomedia.co. Please give us reasonable time to fix it before disclosing it. We will not take action against good-faith research.