Security Policy

Effective date: February 17, 2026 | Version: 2026.02-global

This Security Policy defines baseline controls for identity management, secure development, infrastructure hardening, monitoring, incident response, and resilience operations.

Security controls are risk-based and must be continuously improved as threats evolve.

Scope and Applicability

Applies to applications, APIs, databases, storage, and production infrastructure.
Applies to employees, contractors, and partners with system or data access.
Applies to code delivery pipelines, release workflows, and dependency management.
Applies to detection, logging, alerting, and incident response processes.
Applies to third-party services that process platform data.
Applies to business continuity and disaster recovery controls.

Mandatory Requirements

Identity and Access Control

Access must follow least privilege with role-based authorization controls.
Privileged operations require strong authentication and user-level attribution.
Inactive or orphaned accounts must be disabled on a defined schedule.
Credentials and secrets must be rotated and never hardcoded in repositories.

Secure Engineering and Deployment

Code changes must pass security checks aligned to system risk.
Dependencies require vulnerability scanning and timely patching.
Production release flows must include approval gates and rollback plans.
Security-critical changes require peer review and traceable documentation.

Monitoring and Incident Response

Security telemetry must cover access abuse, anomaly detection, and policy bypass attempts.
Incident severities and escalation responsibilities must be defined.
Forensic artifacts should be preserved for root-cause and legal review.
Post-incident actions must produce measurable control improvements.

Prohibited Practices

Sharing privileged credentials without individual accountability.
Deploying directly to production outside approved release processes.
Ignoring critical security findings beyond remediation timelines.
Disabling logs or monitoring to hide operational actions.
Transferring sensitive data through unapproved personal channels.
Bypassing MFA or endpoint protections for convenience.
Running unauthorized penetration activities against production systems.
Concealing known incidents from designated response owners.

Governance, Monitoring, and Enforcement

Security control owners maintain evidence for internal and external audit readiness.
Risk registers track findings, remediation status, and residual risk decisions.
Critical controls are retested after material architecture or process changes.
Vendor security posture is assessed during onboarding and renewal cycles.
Mandatory security training applies to all personnel with platform access.
Incident KPIs are reviewed for detection speed, containment, and recurrence.
Emergency changes require retrospective review and documentation closure.
Policy updates are versioned and communicated to affected teams.

Global Source Links and Standards

Operational Interpretation and Regional Mapping

These requirements should be interpreted as global baseline controls for a live ad operations platform. Teams must map each requirement to local legal obligations, contractual duties, and traffic-source constraints before enabling production delivery at scale.

When regional regulations impose stricter standards, the stricter standard applies. Where legal ambiguity exists, operations should default to least-risk handling and documented escalation to legal or compliance owners.

Policy-to-Workflow Mapping

Map each policy control to one concrete workflow checkpoint.
Define accountable owner, review cadence, and evidence source.
Link policy failures to clear remediation and rollback actions.
Track policy exceptions with expiry and approval metadata.

Evidence and Audit Quality

Keep verifiable logs for approvals, enforcement, and account state changes.
Maintain immutable records for policy acceptance and version changes.
Preserve incident evidence with timestamp accuracy and actor context.
Support regulator and partner audits with structured evidence retrieval.

Release and Change Governance

Run policy impact review before major workflow or billing changes.
Gate high-risk releases behind compliance and security readiness checks.
Document rollback criteria for policy or abuse regressions.
Communicate material policy updates with effective-date clarity.

Extended Compliance Checklist

Confirm access controls for admin, publisher, advertiser, and support roles.
Verify domain ownership, sitemap coverage, and install-code integrity before launch.
Validate ad creatives, landing behavior, and category eligibility rules.
Ensure budget, spend, and settlement paths align with billing model selection.
Run fraud and abuse controls for both ad-serving and click attribution pathways.
Confirm user data handling for consent, retention, and rights-response timelines.
Check payout safeguards, webhook integrity, and transaction audit visibility.
Review security events, incident triage flow, and postmortem documentation quality.
Ensure policy pages remain reachable, indexable, and version-consistent in sitemap.
Require periodic policy refresh training for operational and support teams.

Policy FAQ for Operations Teams

How often should this policy be reviewed?

Review before each major release and at recurring governance intervals, especially when billing logic, targeting controls, or verification workflows change.

What happens if live behavior conflicts with policy text?

Live enforcement should default to safer behavior immediately, then trigger incident review and documented correction to either implementation or policy wording.

How should teams handle partner-specific requirements?

Apply partner requirements as stricter overlays where needed, while preserving baseline platform controls and maintaining auditable policy-to-process mapping.