Access and account controls
Gaaba is designed around controlled access to business reporting data. Access should be limited to authorized users and configured according to agency roles.
- Least-privilege access model
- Role-based operation where supported
- Administrative review of account connections
Data handling approach
Google Ads data can reveal spend, revenue signals, and business strategy. The product should treat that data as confidential agency and client information.
- Use reporting data only for stated workflow purposes
- Avoid exposing raw provider responses in public outputs
- Keep sensitive configuration outside public files
Website security controls
The public website package includes clean URLs, HTTPS enforcement, security headers, protected configuration folders, and reduced public attack surface.
- HTTPS enforcement
- Restricted config and include paths
- Content security policy configured for required assets
Operational review
Security is not only code. Production use should include periodic checks of SMTP credentials, access logs, Google OAuth configuration, and any connected third-party service.
- Review credentials regularly
- Remove unused accounts
- Monitor failed form submissions and abuse patterns