Controls designed for token protection, least-privilege access, auditability, and a documented deletion mechanism.

System user tokens and OAuth tokens are encrypted at rest. Permissions are limited to scopes granted by the client.
Tokens may be revoked by the client at any time via Meta Business Manager.
Clients may request deletion of stored publishing logs or related operational data. Requests are processed within 30 days of verification.
View Data Deletion Policy