glimmio.
Get Started

Security

We prioritize the security of your advertising and customer data. This document outlines our security architecture and practices.

Infrastructure & Hosting

Glimmio is hosted on Hostinger cloud infrastructure in Mumbai, India. Our deployment follows these practices:

  • Network Isolation: PostgreSQL and Redis are bound to the internal Docker network and are not published to the public internet. A Caddy reverse proxy is the only entry point.
  • TLS Termination: Caddy provisions and renews certificates automatically, and redirects all plaintext traffic to HTTPS.
  • Host Firewall: Inbound access is restricted to HTTP, HTTPS, and SSH.

Data Encryption

  • In Transit: All data transmitted between clients (browsers, APIs) and Glimmio is encrypted using TLS 1.3.
  • At Rest: Data stored in our PostgreSQL database and on the encrypted asset volume is protected by full-disk encryption.
  • Secrets Management: OAuth tokens, API keys, and other secrets are encrypted at the application level before being stored in the database, using AES-256-GCM with a key held only in the server environment.

Authentication & Authorization

  • OAuth 2.0: We use standard OAuth flows for Meta, Google, and Shopify. We do not ask for or store passwords for these services.
  • RBAC: Role-Based Access Control ensures users can only access data and perform actions appropriate for their role (Owner, Admin, Manager, Media Buyer).
  • Session Management: Sessions are managed securely using HTTP-only, secure cookies with strict SameSite policies.

Vulnerability Management

  • Dependency Scanning: We use automated tools to scan for known vulnerabilities in our dependencies (npm audit, Dependabot).
  • Container Scanning: Docker images are scanned for vulnerabilities before deployment.
  • Responsible Disclosure: We welcome security researchers to report vulnerabilities to security@glimmio.com.

AI Providers & Data Sharing

We use Anthropic (Claude) and OpenAI for our AI features. We have enterprise agreements in place that strictly prohibit these providers from using Glimmio API data to train their models. Your data is processed for inference only and discarded according to their zero-retention policies.

Compliance

Glimmio is currently undergoing an independent audit for SOC 2 Type I compliance, with completion expected in Q3 2026. We act as a Data Processor under GDPR and a Service Provider under CCPA.