Answer 7 questions

Security

Effective November 3, 2026

1Signal holds access to your Meta ad account and your clients' campaign data. This page says what we do to protect it, what we have not done yet, and how to check. Every claim on this page is something you can verify, or we say it is not true yet.

What is in place today

  • Everything travels encrypted. Every page and API call uses HTTPS. Browsers are told to never use plain HTTP again (HSTS), to never show the app inside another site’s frame, and to run only scripts we ship (a Content Security Policy).
  • Your Meta key is sealed. When you connect Meta, the access token is encrypted (AES-256-GCM) before it is stored, and the encryption is bound to your client record so a key copied to another record will not open. It is never stored in an environment variable, never sent to a browser, and deleted when you disconnect. The same applies to a CRM key you connect.
  • Passwords are hashed, never stored. We keep a bcrypt hash. Repeated wrong passwords from one address are slowed and then blocked for a while, and password reset requests are limited the same way.
  • Sessions end on their own. A sign in lasts at most 30 days and ends after 7 days without use, on every device.
  • Two-step sign in. Every account can add a second step with an authenticator app (Google Authenticator, 1Password, Authy and the like), with one time recovery codes. Turn it on in the app under Settings, Security.
  • Every client can see who looked. Each client has an access log inside the app: when their data was opened, by whom (you, your agency or 1Signal support), what was opened and from which network, kept for 180 days.
  • Every request is checked for who you are. Each API endpoint that returns a client’s data checks the signed in person’s right to that client on the server, and the app refuses a reply that names a different client than the one it asked for.
  • Automatic checks on every change. Before any code change is merged, an automated scan looks for leaked keys and passwords in the code and for known vulnerable packages in what we ship. After every deploy, an automated break-in test signs in as one client and asks every per-client endpoint for another client’s data, and fails the build if any of them answers.
  • Where your data lives. The database runs on Neon in AWS Frankfurt (eu-central-1), encrypted at rest and in transit, with point in time restore for the last 7 days. The app runs on DigitalOcean App Platform in Frankfurt (fra1) behind Cloudflare. Files such as ad images are stored in DigitalOcean Spaces.
  • A written plan for the bad day. We keep an incident response plan and a step by step restore procedure in our code repository, and the restore is drilled every quarter (the date of the last drill is listed here once it has run). If an incident affects your data, we tell you within 72 hours of confirming it, with what happened and what we did.

What is not done yet

We would rather you read this here than find out later.

  • No independent penetration test yet. Our security testing is automated and our own. We have not paid an outside firm to attack the app. When we do, the report summary goes on this page.
  • No SOC 2 or ISO 27001. We are a small team and have not started a certification. We do not claim one anywhere.
  • One encryption key, bound per client. Sealed keys use one master key with your client id bound into the encryption, not a separate key per client. A per-client key with rotation is on the list.
  • The database does not enforce the wall itself yet. Client separation is enforced in the app on every request and checked by the break-in test after every deploy. Row level security inside the database, a second wall, is planned.
  • Meta permissions. The Meta connection asks for the permissions a test needs to create and pause ads. A narrower read only mode for accounts that only want reporting is planned.

Who processes your data

These are the companies that can hold or see some of your data while 1Signal does its work, and why. We add to this list before a new one touches customer data.

  • DigitalOcean (Frankfurt, Germany): runs the app and stores uploaded files.
  • Neon (AWS Frankfurt, Germany): the database.
  • Cloudflare: network edge, HTTPS and protection against floods of traffic.
  • Meta: your own ad account, through the access you grant.
  • Anthropic: the AI model that writes offer reports, test drafts and analyses from your answers and your campaign numbers.
  • Higgsfield and Pikzels: generate ad images from prompts for the Image step.
  • Firecrawl, Apify and Exa: read public web pages for the offer report.
  • Resend: sends the app’s emails. Twilio: text messages and phone number checks, when a program uses them.
  • Stripe: subscriptions and card payments. Card numbers never reach our servers.
  • Sentry: error reports from the server, with no customer content in them by design.
  • PostHog, Microsoft Clarity and Google Analytics: usage analytics on 1signal.io and for workspace users in the app, only after consent, never for a client login.
  • Your own CRM (for example Attio or HubSpot), only when you connect it, read only.

How to check

  • Open the browser’s developer tools on any app page and read the response headers: Strict-Transport- Security, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options are set on every reply. Or let a public scanner read them for you: securityheaders.com graded app.1signal.io A+ on November 4, 2026, all six headers present. Run it again any time; the grade on this page is only as good as the scan you run yourself.
  • Open /.well-known/security.txt on 1signal.io, app.1signal.io or founderscale.ceo: the same contact on each.
  • In the app, open a client, then Access log: your own visit is listed within a few minutes.
  • Turn on two-step sign in under Settings, Security, sign out and sign in again.
  • The checks and the break-in test are plain scripts in our code repository. Ask at [email protected] and we will send you the current versions.

Report a problem

If you believe you found a security weakness in 1Signal, email [email protected]. You hear back from a human within two business days. We will not take legal action against research done in good faith that does not read or change other people’s data and does not disrupt the service, and we will say thank you on this page if you want us to. Please do not run automated scanners against the live app without asking first.

GDPR and data processing

1Signal is operated by FounderScale LLC, Fort Lauderdale, FL, United States, and stores customer data in Germany. If you need a data processing addendum for your own GDPR records, it is at 1signal.io/dpa. To have your data deleted, see data deletion.