Credential storage
Every API key and access token the plugin stores — Meta, Google, Klaviyo, SendGrid — is encrypted at rest before it's written to your WordPress database, using a key derived from your own site's WordPress salts. Nothing is ever stored in plaintext.
AI generation doesn't need your own API key
AI generation (ad copy, budget recommendations, and every other Claude-powered feature) always routes through a relay service we operate, which holds our own Anthropic key and meters usage against your plan — there's no option to point this at your own Anthropic account, by design: the relay is also where the underlying prompt logic lives, not just a metering pass-through. Image generation is metered the same way by default, with an Advanced: use your own OpenAI or Gemini key option in Settings for anyone who'd rather opt out of metering and spend on their own account instead — off by default, never the primary flow.
Relay authentication
Every request from your site to the relay is authenticated with a per-site key, generated once during pairing and never transmitted again — the relay stores only a hash of it, the same way a password would be stored. Pairing itself is verified server-to-server against your real Freemius license or (for the Free plan) your Freemius install's own credentials — not a self-reported identifier a tampered site could fake. In the free version distributed through WordPress.org, the plugin makes no request to the relay at all until the site owner connects their account, so a fresh install is silent.
Platform connections
Meta and Google Ads connections use standard OAuth 2.0 — your site never sees or stores a Meta or Google password, only a scoped access token, and the app credentials themselves live on our infrastructure rather than shipping inside the plugin.
API access
The plugin's dashboard REST endpoints require WordPress's own manage_woocommerce capability and a valid nonce — the same authentication boundary WordPress itself uses, not a separate, weaker one. The only exceptions are the public visitor-attribution beacon and the one-time signed callbacks used by background jobs, which authenticate differently by design.
Ongoing hardening
We run our own internal security reviews against both the plugin and the relay on an ongoing basis, including the trust boundary between them, and ship fixes as issues are found rather than waiting for a scheduled release. If you believe you've found a security issue, please report it directly rather than filing it publicly.