Security
Last updated July 16, 2026
Vitalis AI connects to the advertising accounts that run your business. That access is the most sensitive thing we hold, and the design reflects it: your budget cannot move without your click, your tokens are encrypted before they touch our database, and one workspace can never read another’s data.
The approval gate
Our most important safeguard isn’t a policy - it’s enforced in the database. Any action that would move real ad dollars (launching a campaign, raising a live budget, un-pausing) is marked gated, and a Postgres trigger refuses to let it execute without a recorded human approval. Campaigns are constructed in a paused state, which costs nothing. Even if the application layer had a bug, the database would still refuse to spend your money.
Credentials
- Access and refresh tokens are encrypted with AES-256-GCM before being written to the database. The key lives only in the application server’s environment, never in the database - so a database dump alone cannot yield a usable token.
- Tokens are never shown back to you, never sent to your browser, and never written to logs.
- We never ask for your Meta or Google password. You connect by logging in with the provider, and you choose exactly which ad account, Page, and pixel to share.
- You can revoke our access at any time - from the Connections page, or directly from your Google Account permissions or Facebook Business Integrations.
Tenant isolation
Every table is protected by Postgres Row Level Security, scoped to the workspace of the signed-in user. Data access goes through security-definer functions that derive your workspace from your session - not from anything the browser sends - so a caller cannot read or write another workspace’s data by changing a request.
Infrastructure
- Hosted on Vercel; database, authentication, and file storage on Supabase.
- All traffic is served over HTTPS/TLS.
- Secrets are held in an encrypted environment store, separate from source control. Our repository contains no credentials.
- Payment card details are handled by Stripe directly. We never see or store card numbers.
AI providers
The agents run on Anthropic, and creative is generated by Higgsfield and Google (Veo). Your campaign context is sent to these providers to produce plans and creative for you. Your business data and your advertising data are never used to train AI models.
Connection health
A dead credential is a security and correctness problem, so we track token expiry, renew tokens before they lapse, and detect provider errors that mean access was revoked. When that happens the app tells you plainly and asks you to reconnect, rather than silently continuing with stale or sample data.
Reporting a vulnerability
If you believe you’ve found a security issue, email support@govitalisai.comwith the details and steps to reproduce. We’ll acknowledge it and keep you updated. Please give us a reasonable chance to fix it before disclosing it publicly.