Effective date: 2 November 2026 · Security contact: connect@aboveceo.com · Operator: AboveCEO Online Consulting LLP, Maharashtra, India

This Security Policy describes AboveCEO’s security practices for its website and SaaS Services. Security is a continuing risk-management program, not a guarantee that every attack, outage or data loss can be prevented. Controls may differ by service, feature and deployment. We do not claim SOC 2, ISO 27001 or another independent security certification unless separately stated in a current signed document.

1. Security objectives and responsibilities

AboveCEO works to protect confidentiality, integrity and availability of account and Customer Data through safeguards appropriate to the service and risk. Security is shared: we protect the platform within our control; customers must secure their accounts, devices, users, connected services, integrations, uploaded data, consent notices and configuration. Customers should grant only the permissions required for their use case and remove users and integrations that are no longer needed.

2. Access and identity safeguards

The application uses authentication sessions and workspace roles/permissions to limit actions to authorised users. Session credentials are designed to be handled using protected browser cookies, and sensitive operations are performed by authenticated server endpoints. Access to connected platform data is associated with the authorising AboveCEO user/workspace and the permissions allowed by the provider. Customers control workspace invitations, user access and roles. These are application-level controls; actual enforcement also depends on production configuration and account administration.

3. Credential and data protections

Connected-platform OAuth credentials are handled server-side rather than intentionally exposed as browser-readable credentials. Meta and Google Ads integration vault code uses AES-256-GCM encryption for stored connection records. Application password storage uses a salted scrypt-based derivation in the SaaS authentication store. API inputs are validated, CMS rich text is sanitised against an allowlist, and product endpoints apply authentication, authorisation, tenant and entitlement checks. These technical controls do not establish encryption at rest for every database, file, backup or deployment component. Production encryption, key custody and infrastructure configuration must be assessed separately.

We design browser and API communication for HTTPS operation. The live TLS configuration, network boundary, production firewall, backup encryption and key-management configuration are infrastructure matters and are not represented here as independently verified certifications or guarantees. Never send passwords, secret keys, recovery codes or access tokens by email.

4. Operational safeguards

We use or develop safeguards including role-based access, request validation, rate limiting, security event logging with sensitive values redacted, integration-scope controls and processes to maintain and improve software. Internal access should be limited to people who need it to operate or support the service. Customers can contact us to ask for a current security overview or available technical and organisational measures. We may share further non-public details under appropriate confidentiality terms.

5. Security incidents

If we become aware of a security incident affecting personal data, we will investigate, take reasonable steps to contain and remediate it, preserve relevant evidence, and provide notices to affected customers, individuals or authorities when and as required by applicable law or contract. Notification timing and recipients depend on the facts, risk and governing legal requirements. We do not promise that every attempted intrusion will be detected or that every incident can be prevented.

6. Vulnerability reporting

Please report suspected vulnerabilities to connect@aboveceo.com with “Security report” in the subject. Include the affected URL or component, impact, reproduction steps and a safe proof of concept. Do not access, alter, download or disclose another person’s information; disrupt services; conduct denial-of-service testing; use social engineering; or test systems you do not own or have permission to assess. Give us a reasonable opportunity to investigate before public disclosure. We will acknowledge reports as practicable and may request clarification. This contact is not an emergency line; do not include real customer data or secrets in a report.

7. Customer security actions

• Use a unique, strong password and protect the email account used to sign in.
• Restrict workspace roles, review invitations and remove access when responsibilities change.
• Authorise only the advertising, analytics, page and website assets you intend to connect; review provider permissions and revoke stale grants.
• Keep devices, browsers and third-party services updated and secured.
• Do not place secret keys or passwords in campaign names, CRM notes, analytics parameters, CMS content or support messages.
• Use appropriate visitor notices and consent controls before deploying tracking on your own websites.
• Maintain independent copies of important business records and promptly report suspicious account activity.

8. Legal and regulatory framework

We seek to maintain safeguards consistent with applicable legal requirements, which may include India’s Digital Personal Data Protection Act, 2023 and Rules, 2025 as applicable and as relevant provisions commence; GDPR/UK GDPR security requirements where applicable; and other mandatory privacy, cybersecurity and breach-notification laws that apply to a specific processing activity. Laws may require risk-based safeguards, incident records or notices within specified periods. This policy is not a certification or a representation that every statutory obligation is satisfied in every jurisdiction.

9. Changes and contact

We may revise this policy as systems and safeguards change. The effective date above identifies the version currently published. For security questions, a security overview, vulnerability reporting or incident notification, contact connect@aboveceo.com.