Alfred
Felix
Herman
Frida
Viktor
Maja
Iris
Thor
Nora
Lucas
Security in the app where you are in control
The heroes work in your accounts every day. Here you see what they can do, what needs your yes and how we protect the data.
A free 30 minute call with one of us
Suggestion from AstridIncrease the daily budget to $30
Your yes
- Within what you have allowed
-
Vera has checked exactly this version
- Fresh numbers still support the suggestion
- No other change is waiting on the campaign
- Within your budget limit
Done, and can be undone
In short
- Servers in StockholmThe database is in Ireland, both in the EU/EEA.
- Encrypted accessAccess is stored encrypted with AES-256-GCM and never sent to the browser.
- Daily backupThe database is copied every day.
- Not trained on your dataUnder the terms of the APIs we use.
- Every action is loggedBefore it is done, and you see the history in the app.
- Big changes need your yesBudget, new ads and new keywords.
Customers who trust us
The principles
Four rules that govern everything
-
Big changes need your yes
Budget, new ads, new keywords and pausing a whole campaign are never done without your yes.
-
Access is locked away
Access to Google, Meta and WordPress is stored encrypted with AES-256-GCM and is never sent to the browser.
-
Your data is only yours
Each business only sees its own data. This is enforced both in the database and in the code, and it is tested.
-
A person has the final say
Behind the heroes is a team at Heyroes. We can stop a hero, a customer or the whole system with one button.
Before anything changes
Five checks after your yes
After you have said yes, the change goes through five checks in this order. If one of them stops it, nothing happens.
-
Within what you have allowed
Every action has a level. The heroes only do what you have allowed them to, and some things they never do.
-
Vera has checked exactly this version
Vera checks the text and the action. If a single word changes, she checks again. If she is unsure, it stops, and only a person at Heyroes can override her.
Vera
-
Fresh numbers still support the suggestion
The rule is run again with current numbers. If something has changed, the suggestion is marked outdated and nothing is done.
-
No other change is waiting
If an earlier change on the same campaign hasn't been settled, the new one waits until it has.
-
The budget limit holds
The budget is reserved before the change is made. If the numbers from Google or Meta are delayed, there is no increase.
Everything is written to the log before it is done, and changes to the ads can be undone.
The limits
What the heroes can do
By default everything needs your yes. Here is the full list, including what they can do on their own if you switch it on.
-
Even if you switch it on
- Add negative keywords
- Pause an ad
Both can be undone, and the heroes must be at least 99% sure. By default it is off.
-
Always with your yes
- Change the budget
- Create new ads
- Add new keywords
- Pause a whole campaign
- Publish on the website
You see what changes and the numbers behind it before you answer.
-
Never
- Sign contracts
- Pay or change prices
- Give themselves new access
- Delete anything for good
- Touch the accounting
These are outside what the heroes are allowed to do, no matter who asks.
One exception: if you have allowed it, Astrid can pause a campaign when the landing page returns an error twice in a row, so you don't pay for clicks to a page that doesn't work. The campaign only starts again with your yes.
The connections
The access we ask for and why
We only ask for what the heroes need to do the job, and we say plainly what it is.
-
Google Ads
Can change, with your yes
You connect with a Google sign-in. The access lets Astrid make changes, but big changes always need your yes. If you disconnect, the access is withdrawn at Google.
-
Meta Ads
Can change, with your yes
You give access to the ad account in Business Manager and remove it there whenever you like. The app checks per account whether it is allowed to change anything.
-
Google Analytics 4
Read access only
The app reads visits and leads per channel and landing page. It can't change anything in Analytics.
-
Search Console
Reads and submits sitemaps
The app reads keywords, clicks and impressions, and can submit a sitemap so Google finds new pages faster.
-
WordPress
Publishes what you have approved
The connection uses an application password that is stored encrypted. Only articles you have approved are published, and you can disconnect whenever you like.
Data and operations
How we protect your data
-
Storage and operations
- EU/EEA
- The servers run in Stockholm and the database is in Ireland.
- AES-256-GCM
- Access and passwords are encrypted, and the key can be replaced.
- Daily copy
- The database is backed up every day.
- Separate test
- Test and production are completely separate. The test environment can't change anything in Google Ads, Meta or the accounting.
- HTTPS
- All traffic is encrypted.
-
AI and your data
- Claude and OpenAI
- The heroes use Claude from Anthropic, and images are made with OpenAI. All calls go from our servers, never from the browser.
- No training
- Under the terms of the APIs we use, the models aren't trained on your data.
- No keys out
- Keys, passwords and tokens are removed before anything is sent to a model.
- Guards
- Attempts to trick the heroes with hidden instructions in text they read are stopped.
- Cost caps
- Every customer and every hero has a cap, so an error never runs away.
-
Sign in and access
- Invitation only
- New users in your company only get in by invitation from us or from your administrator. If someone signs up on their own, they get a new, empty company and must confirm their email with a one-time code.
- Removed at once
- If you remove someone's access, it applies at once, and they are signed out.
- New administrators
- All administrators are notified when someone gets the administrator role.
- New password
- If you change your password, all other devices are signed out.
- Roles
- Everything in the app is closed unless your role gives access.
-
Log and traceability
- Before the action
- Every action is written to the log before it is done, and you see the history in the app.
- Sign ins
- Sign ins and sign outs are logged.
- Audit log
- Changes and deletions are stored in a log that isn't changed afterward.
- Errors
- Errors are monitored, and personal data is scrubbed out before anything is sent.
- Alerts
- The jobs that run on their own are monitored, and we get an alert if something stops.
On the way
- Two-factor sign-in
- Delete and export your data yourself in the app
- Disconnect Google Analytics and Search Console in the app
Report a security issue
If you have found something that looks like a security hole, we would like to hear about it. Write to us and we will reply within 24 hours on weekdays. Please don't share the details publicly until we have fixed it.
security@heyroes.comPrivacy and agreements
Wonder Technologies AS is the company behind Heyroes and is responsible for the data in the app. If you want us to delete or hand over your data, write to us.
Questions and answers
What people ask about the security
Is it safe to give AI access to a Google Ads account?
The heroes can only do two small things without your yes, and only if you have switched it on: add negative keywords and pause an ad. Budget, new ads, new keywords and pausing a whole campaign always need your yes, and the changes can be undone.
Can the heroes spend more of the budget without me knowing?
No. You set a limit per month, and the budget is reserved before a change is made. Any increase needs your yes, and if the numbers from Google or Meta are delayed, there is no increase.
Where is our data stored?
The servers run in Stockholm and the database is in Ireland, both in the EU/EEA. Access and passwords are stored encrypted with AES-256-GCM.
Is our data used to train AI?
No. We use the APIs from Anthropic and OpenAI, and under their terms the models aren't trained on data sent through the APIs. Keys and passwords are removed before anything is sent.
Who at your company can see our data?
The team assigned to your account and our administrators. Every request is checked against the role, and other customers can never see your data.
What happens if the heroes make a mistake?
Every action is logged before it is done, and changes to the ads can be undone. We can stop a hero or the whole system with one button, and a person at Heyroes is responsible.
How do I remove your access?
You disconnect Google Ads and WordPress in the app, and remove the access to Meta in Business Manager. Disconnecting Google Analytics and Search Console in the app is on the way, and until then we will help you.
Does the app have two-factor sign-in?
Not yet, but it is on the way. Today nobody gets into your company without an invitation, and if you remove someone's access, it applies at once.
How do I report a security issue?
Write to security@heyroes.com. We reply within 24 hours on weekdays.
How the heroes work
One system One goal Growth you can measure
No guesswork, and no reports that each say something different.
Iris makes the growth plan, and the heroes work to it with the same numbers from your website, search and ads. Vera checks the work before it goes out. Felix keeps it all together. You have the final say.
Let's talk
Safe growth starts with a call
We answer your questions and help you choose the next step.
30 minutes · Free and no obligation
Behind the heroes is a team at Heyroes who are responsible for the work.
