Accounts and credentials
-
01
Encrypted at rest
OAuth tokens and API keys for your integrations are encrypted per row with AES-256-GCM and decrypted only at the moment of a call. Keys can be rotated without downtime, and old ciphertexts are re-encrypted with the new key.
-
02
Hashed, never stored
Session tokens, personal API tokens, invite links, e-mail verification and password reset tokens are stored as SHA-256 hashes. Reset links are single use and expire after an hour.
-
03
Roles and scoped tokens
Organisations contain workspaces with role-based memberships. Personal API tokens carry scopes, can be read-only, expire, and are rate limited. Sessions can be revoked from the account page.
-
04
Official APIs only
Demander connects to platforms with OAuth through their published APIs. It never asks for platform passwords and never drives a browser session on your behalf.
Tenant isolation
-
01
Every row belongs to a workspace
All customer data carries a workspace id, and every query is scoped to the workspace of the authenticated membership. Requests for another tenant’s records answer as if they did not exist.
-
02
Tested at the HTTP layer
The test suite sends cross-tenant ids to the API and checks that each one is refused, for sessions and for API tokens alike.
-
03
Outbound requests guarded
Crawling, webhooks and lead forwarding go through a client that refuses private and internal addresses, so a URL entered in Demander cannot reach its own network.
Personal data, by design
| Data | How Demander handles it |
|---|---|
| Website visitors | The tracker has strict, balanced and off modes. In strict mode nothing identifies a visitor before consent. Global Privacy Control and Do Not Track count as no marketing consent, and withdrawing consent deletes stored ids. |
| IP addresses | Never stored raw: a salted hash that rotates daily, and truncated prefixes for company lookup. |
| Company identification | Company level only, and only with a documented legitimate interest assessment or marketing consent. ISPs, mobile carriers and data centres are filtered out. |
| People | Identified only when they identify themselves: a form, a reply, or a confirmed opt-in. Never inferred from behaviour. |
| Outreach | Checked against the rules of the recipient’s country at enrolment and again at send. Unsubscribes, hard bounces and complaints suppress the address at once. |
| Ad audiences | Hashed e-mails reach ad platforms only for contacts with explicit marketing consent who did not opt out; prospected people are never uploaded. |
The details are in the privacy policy, the cookie notice and the DPA.
Hosting, backups and monitoring
-
01
EU hosting
The application and its database run in the EU. The current sub-processors and where they process data are listed in the DPA.
-
02
Backups that are restored, not only taken
Daily database dumps with checksums go to encrypted object storage at a second site, with versioning. A restore drill runs monthly against a throwaway instance.
-
03
Scrubbed error reports
Error reports drop request bodies and mask e-mail addresses, credentials, tokens and IP addresses before they leave the server.
-
04
Rate limits and abuse controls
Public endpoints are rate limited, the tracker’s collection endpoint cannot grant consent, and hosted forms use a honeypot and double opt-in.
Automation that can be audited
Every change Demander makes to an ad account, a mailbox or a social profile is a proposed action with a reason and evidence, checked by a deterministic gate before it runs, recorded in the audit log, and reversible. AI agents connected over the API or MCP get exactly the same gate and the same log.
Questions people ask
Do you have a DPA?
Yes. The data processing agreement under Article 28 GDPR, with the list of sub-processors and the security measures, is at /legal/dpa.
What happens to our data if we leave?
You can delete a workspace, the whole organisation or your account. Deletion removes your data, including brand files, and cancels the subscription first. Campaigns and audiences stay in your own ad accounts.
Can Demander spend money we did not approve?
Only inside the autonomy level and caps you set, and never past the hard limits: kill switch, daily and monthly caps, the daily change limit and the tracking check. Every automated change is logged and can be undone.
Is AI-generated media labelled?
Yes. Media generated with AI is flagged for the EU AI Act transparency rules and the platforms’ own labels.