Advertisers and AI platforms trust Gravity with campaign data, ad requests, and the contextual signals that make ads relevant. This page describes how we protect that information and how to reach us about a security concern. The technical and organisational measures that apply to personal data are set out in Annex 4 of our Data Processing Addendum.

Infrastructure and hosting

Gravity runs on established cloud infrastructure providers that hold recognized independent security certifications and are responsible for the physical security of their data centres. We do not operate our own data centres. Production infrastructure is defined in code, so changes to it are versioned and reviewable.

Encryption

Data is encrypted in transit over public networks using TLS, and encrypted at rest in our primary databases and storage using industry-standard methods. Integrations with Gravity, including the API, SDKs, and pixel, use authenticated, encrypted connections.

Access control

Access to production systems and to systems that hold personal data is limited to authorized personnel with a business need. Access is protected by authentication controls appropriate to the sensitivity of each system, and access is removed when it is no longer needed.

Secure development and change management

All code lives in version control. Changes reach production through pull requests that run automated tests, security checks such as secret scanning, and code review before they merge. Deployments run through automated pipelines with a staging step before production, so every release is traceable to the change that produced it.

Vulnerability management

We take reasonable steps to find and fix security vulnerabilities, including automated scanning of dependencies and container images in our development pipeline. We prioritize fixes by severity.

Monitoring, availability, and incident response

We log production systems for security monitoring and investigation, and we alert on the health of our services. Backup, restoration, redundancy, and failover measures help us maintain and restore service. When an incident happens, we work to contain it, find the root cause, and fix it, and we notify affected customers where the law or our agreements require it.

Data protection and privacy

We minimize the personal data we accept through our integrations, mask certain identifiers in free-text content before it is used in model prompts, and do not select advertising on the basis of sensitive or protected characteristics. How we collect, use, share, and retain information is described in our Privacy Policy, and the data protection terms that apply to customers are in our DPA. Our list of sub-processors is available at trygravity.com/subprocessors.

Reporting a vulnerability

If you believe you have found a security vulnerability in Gravity, please email [email protected] with the subject line "Security report". Include a description of the issue, the steps to reproduce it, and any affected URLs or endpoints. We review reports we receive in good faith.

Please give us reasonable time to fix the issue before you share it publicly, and do not access or change data that is not yours, degrade the service, or use social engineering. As our Terms of Service state, penetration testing and security scanning of the Services need our prior written consent.

Contact

For security questions, or to request more information as part of a security review, contact us at [email protected].

Security at Gravity