Trust Centre
What we can see, what we cannot touch, and what happens when you leave
How the HighRegard application handles your Google accounts and your data, written from what the code does rather than from a policy template. Where something is planned rather than in place, it says so.
In numbers
Read-only by design, encrypted per workspace, deleted on disconnect, and no code path that writes to your accounts.
At a glance
The controls, in one screen
Each card is expanded below with what the application actually does.
Read-only scopes
Search Console and Analytics read-only; Ads writes hard-off in code.
Per-workspace encryption
AES-256-GCM, keys derived per workspace from a master key held outside the database.
Deleted on disconnect
Credential removed immediately, logged; facts gone within 30 days of closing.
Tenant isolation
Every query scoped to your workspace; the demo shares no storage.
Audit log
Connections, settings and decisions recorded with user and time.
AI sees aggregates only
Named, pre-formatted metrics; never rows, credentials or your customers.
In place today
Controls that are live
Read-only access to your Google accounts
Connecting a source uses Google sign-in with the narrowest scopes Google offers for reading: Search Console webmasters.readonly and Analytics analytics.readonly. Google Ads has no read-only scope, so the standard adwords scope is requested; in the application every code path that could change a campaign, budget, bid or keyword is switched off at the code level and cannot be enabled by configuration — the flags for Ads writes, automated optimisation and offline conversion upload are hard-off and covered by a unit test that asserts they stay off even when set to true.
Nothing in the application changes a campaign, bid, budget, page or setting. Recommendations are written down for a person to act on.
Credentials encrypted per workspace
Each connection’s refresh token is encrypted with AES-256-GCM under a key derived for that workspace alone from a master key held in the hosting environment, separately from the database. A token from one workspace cannot be decrypted with another workspace’s key. Sessions are signed, HttpOnly, Secure cookies that expire after 30 days.
Disconnect deletes the credential
Disconnecting a source deletes its stored credential immediately and records the action in the audit log. Facts already ingested stay in the workspace until it is closed, or sooner on request. Closing a workspace deletes its connection credentials at once and its stored facts within 30 days. You can also revoke HighRegard’s access from your own Google account at any time.
Tenant isolation
Every record is keyed to a workspace, and every query the application runs is scoped to the signed-in user’s workspace. The public demo runs on an in-memory synthetic dataset that shares no storage with live workspaces. There is no cross-workspace reporting.
Designed not to hold your customers’ personal data
The application ingests aggregate performance facts (campaign, search-term, query, page, channel and event figures by day) and the settings you enter. It does not collect user identifiers, message text or recordings. Where a provider report could contain a person’s name inside a search query, rows matching personal-data patterns are dropped before storage and query strings are stripped from page paths. Both behaviours are unit-tested.
What the AI provider sees
The optional written assessment on the overview is produced by our AI provider (Anthropic) from named, pre-formatted aggregate metrics and recommendation titles only — never from row-level data, credentials or anything that identifies a customer of yours. The application inserts every figure itself and rejects any text that adds, scales or re-units a number. The Live AI Visibility Test sends the business name, service and town you type in, and nothing else.
Audit log
Connections made, disconnected and authorised, settings changed and recommendation decisions recorded are written to a per-workspace audit log with the acting user and time. Decisions and work items you record are kept for the life of the workspace and can be exported before it is closed.
Access controls
Sign-in is by single-use link to a work email address; there are no passwords to leak. Workspace roles separate owners, who can connect and disconnect sources, from members. Internally, client systems are accessed by invitation rather than shared passwords, with multi-factor authentication on all business systems, a password manager with per-client vaults, least-privilege access and documented offboarding.
Hosting, backups and sub-processors
The website and application run on Vercel; the application database is Neon (managed PostgreSQL, with the provider’s managed backups). Google supplies the Ads, Search Console and Analytics APIs the application reads at your instruction. The full list of sub-processors, and how we notify changes to it, is in the data processing information; each is bound by a data processing agreement, and transfers outside the UK rely on the UK Addendum to Standard Contractual Clauses.
Incident response
If we become aware of a breach affecting your data we will tell you without undue delay, say what was affected and what we have done, and notify the ICO where the law requires it. Report anything suspicious to hello@highregard.co.uk; security reports are treated as defects, not feedback.
Planned
Listed so you can hold us to them
Neither of these is claimed as in place.
- Cyber Essentials certification
We intend to certify against Cyber Essentials, the UK government-backed baseline, before opening the application to a large number of live connections. It is listed here as planned, not as held.
- Google verification of the OAuth application
Live Google connections are opened to customers as part of a purchase, in stages. Where a Google API requires the OAuth application to be approved by Google for the scopes above, the Data Sources page in the workspace says “requires provider approval” until it is; nothing is shown as connected that is not.
Questions
Common questions
Can HighRegard change anything in my Google Ads account?
No. Google Ads has no read-only scope, so the standard scope is requested, but the application contains no code path that writes to an account and the flags that would allow one are hard-off regardless of configuration. Every change is a recommendation for a person to carry out.
What happens to my data if I stop?
Disconnect a source and its credential is deleted immediately. Close the workspace and its credentials go at once and its stored facts within 30 days. You can ask for an export of your decisions and work items first, and for earlier deletion of stored facts at any time.
Does the demo use anyone’s real data?
No. The demo workspace is a synthetic business generated to exercise the analysis, held in memory, frozen at one date so that the figures quoted on this site match it, and sharing no storage with live workspaces.
Who can see my workspace?
Members of your workspace, and HighRegard staff carrying out the work you have bought, under the data processing agreement issued with every service contract. There is no cross-workspace reporting.
Related documents: privacy notice, data processing information, cookie policy, terms.
Try it on synthetic data first
The demo workspace needs no sign-in and no connection. Your own workspace comes with the audit, the Sprint or a monthly plan.