Security & Cryptographic Isolation
How checkads protects connected business data, OAuth tokens, and financial intelligence with military-grade standards.
AES-256-GCM Credential Vault at Rest
All OAuth access tokens, refresh tokens, and API credentials are encrypted with AES-256-GCM using unique 12-byte initialization vectors (IVs) and 16-byte authentication tags.
Every cipher block binds organization IDs as Additional Authenticated Data (AAD), rendering ciphertext transplantation attacks mathematically impossible across tenants.
Server-Boundary DTO Projection (Zero-Leak Engine)
Metric privacy is not enforced in CSS or client JavaScript. Data projected for public consumption strips raw numeric values before the server response crosses the boundary.
Co-dependent algebraic derivation rules prevent indirect leakage (e.g. if an account owner hides Advertising Spend, Blended MER is automatically masked if Net Revenue is exposed).
Cryptographic SHA-256 Provenance Ledger
Every normalized metric record points to an immutable raw metric snapshot with a SHA-256 cryptographic digest.
If an integration is disconnected or revoked, verified historical records remain permanently frozen with their original verification timestamp and immutable digest.