Security and privacy
Security and privacy: built and hosted in the EU
AdShift runs on Amazon Web Services in Stockholm, works as your data processor under GDPR and respects the consent your users give.
12,000 attributed installs free in your first year. No card.
Hosting
EU
AWS eu-north-1, Stockholm
Under GDPR
Processor
You stay the controller
Consent
TCF v2.2
IAB TCF and GPP signals read by the SDK
What you get
The short version for your security review. The detail follows below.
Hosted in the EU
Production runs on Amazon Web Services in eu-north-1 (Stockholm, Sweden), across three availability zones.
AdShift is your processor
For data about your app's users you stay the controller. A Data Processing Agreement under Article 28 GDPR is part of the contract.
Consent signals in the SDK
The SDK reads the IAB TCF v2.2 and GPP strings your CMP writes and sends advertising identifiers only when the user allows it.
Encryption
The dashboard, the API and SDK traffic use HTTPS. Account databases and our Amazon S3 buckets are encrypted at rest.
Roles and permissions
Five built-in project roles plus custom roles with exactly the permissions you choose, assigned per project.
Support in Polish and English
Questions about security or data protection are answered in Polish or English, on every plan.
Last reviewed on 12 November 2026.
Where your data lives
Production runs in one AWS region inside the European Union. Measurement data is stored as follows.
- Production region
- Amazon Web Services, region eu-north-1 (Stockholm, Sweden), across three availability zones.
- What is stored there
- Clicks, installs, in-app events and attribution results from your apps; your account, project and partner settings; cost and campaign data imported from the ad accounts you connect.
- Reporting warehouse
- Reports are computed in Snowflake, a cloud data warehouse, fed from the storage above.
- Data export staging
- If you switch on data export, files wait in a staging bucket for up to 14 days and are then deleted: Amazon S3 in Stockholm, or Google Cloud Storage in europe-west1 (Belgium) for deliveries to BigQuery.
- Where data goes next
- Only where you send it: postbacks to the ad partners you enable, and exports to the destination you configure (BigQuery, Amazon S3, Snowflake, Google Cloud Storage or Azure Blob Storage). From there it is under your control.
The safeguards for any transfer of personal data outside the European Economic Area are described in the privacy policy.
How it is protected
Encryption
- In transit: the dashboard, the API and the SDK endpoints are served over HTTPS, and plain HTTP requests are redirected to HTTPS.
- At rest: the account databases (PostgreSQL on Amazon RDS) use storage encryption. Our Amazon S3 buckets use server-side encryption and block public access.
Network and infrastructure
- Databases sit in private subnets and cannot be reached from the internet.
- Public endpoints are protected by a web application firewall.
- Service credentials are kept in a managed secrets store, not in code.
Backups
- Account databases are backed up automatically every day.
- The attribution data store is backed up with regular volume snapshots.
Sign-in
- Sign in with email and password, or with Google.
- Passwords are stored only as Argon2id hashes.
- Session cookies are marked HttpOnly and Secure. Changing your password invalidates all existing sessions, so every device has to sign in again.
Roles and permissions
- Five built-in project roles: Project Owner, Project Admin, App Editor, Template Editor and Viewer.
- Custom roles: you choose the exact permissions a role gets, for example apps, partners, billing, members or data export.
- Roles are assigned per project, so a person sees only the projects they were invited to.
Privacy and consent
AdShift measures campaigns for you, on your instructions. That decides who is responsible for what.
Who is responsible for what
For data about the people who use your app, you are the controller and AdShift is the processor: we process it on your behalf (Terms of Use, section 6). For your dashboard account and for this website, ADSHIFT sp. z o.o. is the controller, as the privacy policy describes.
Data Processing Agreement
The Terms of Use name a Data Processing Agreement under Article 28 GDPR as part of the contract. Ask for it at privacy@adshift.com.
What the SDK collects
Advertising identifiers (IDFA on iOS; Google Advertising ID, App Set ID or OAID on Android), a first-party AdShift device ID (a random identifier created for one install of your app), the IP address, device and app details such as model, system version and app version, and the events you choose to send.
Requests from your users
People who use your app contact you, the controller. Send us the request at privacy@adshift.com and we act on your instruction. We can also switch off measurement for a single device from our servers: the SDK then stops sending data from that device until the app is reinstalled.
How consent signals are respected
- The SDK shows no consent screen. You collect consent in your own flow or with a consent management platform (CMP).
- The SDK reads the IAB TCF v2.2 and GPP strings that a CMP writes on the device, once you switch that on in code. You can also pass the answer in yourself.
- For a user under GDPR, advertising identifiers are collected and sent only when both device storage and use of data for advertising are allowed. A question the user has not answered counts as a refusal.
- For those users, events are forwarded to an ad partner only when both are allowed. Google Ads is the exception: it receives the event together with the consent answers, which is how Google's own consent protocol works.
- The first-party AdShift device ID is not an advertising identifier and is sent with every event, whatever the consent answer. Your privacy notice should cover it.
- On iOS the IDFA is read only after the user allows tracking in Apple's App Tracking Transparency prompt. Your app shows that prompt; the SDK does not.
- On Android you can stop the Advertising ID from being collected at all by removing the AD_ID permission, for example in an app for children.
Do you add AdShift to your CMP as a vendor?
AdShift is not registered on the IAB Europe Global Vendor List, so it does not appear among the IAB vendors in your CMP and has no vendor ID to select. The SDK does not look for a vendor entry: it reads the purpose-level consents (TCF purposes 1, 4 and 7). If your CMP lets you declare vendors outside the IAB list, usually called custom vendors, you can list AdShift there as a processor acting on your behalf, and name it in your privacy notice. There is no ready-made integration with a specific CMP.
Retention
There is no single public retention schedule. Measurement data is kept while your account is active. After the contract ends it is deleted or returned as set out in the Data Processing Agreement or order form (Terms of Use, section 21). Export staging files are deleted after 14 days.
Data you should not send
Section 7 of the Terms of Use asks you not to send precise location, payment card or bank details, health data, government identifiers, passwords, or names, email addresses and phone numbers, unless that has been agreed in writing.
Service levels
The public Terms of Use contain no uptime figure. Here is what applies to each plan.
Free and Growth
No contractual SLA. Section 13 of the Terms of Use says AdShift uses commercially reasonable efforts to provide the service in a reliable and secure manner.
Enterprise
Service levels are agreed in your contract: availability, support response times and what happens when data is delayed or lost. Uptime commitments, response times and service credits apply only where an order form, MSA or SLA states them.
What limits data loss in practice
The SDK writes every event to a queue on the device before sending it and keeps retrying until our servers confirm receipt. If a device stays offline long enough to fill the queue, the oldest events are dropped first. On our side, the backups listed above apply.
Not available yet
What AdShift does not offer today.
Single sign-on (SSO)
Not available yet
Sign-in through your company's identity provider (SAML or OpenID Connect). Today you sign in with email and password or with Google.
Audit log
Not available yet
A customer-facing log of who changed what in a project.
Two-factor authentication
Not available yet
A second sign-in factor for email-and-password accounts. With Google sign-in, your Google account's 2-Step Verification applies.
Certifications
Not available yet
AdShift does not hold SOC 2 or ISO 27001 certification today.
Questions about security or data protection
Write to us, or book a demo and we will go through your questions together.
Frequently asked questions
On Amazon Web Services in the eu-north-1 region (Stockholm, Sweden), across three availability zones. Reports are computed in Snowflake. If you use data export, files are staged for up to 14 days in Amazon S3 in Stockholm or, for BigQuery, in Google Cloud Storage in europe-west1 (Belgium).
For data about your app's users you are the controller and AdShift is the processor. The Terms of Use name a Data Processing Agreement under Article 28 GDPR as part of the contract. Ask for it at privacy@adshift.com.
AdShift is not on the IAB Europe Global Vendor List, so it is not among the IAB vendors in your CMP. The SDK reads purpose-level consents (TCF purposes 1, 4 and 7) and does not need a vendor entry. If your CMP supports vendors outside the IAB list, usually called custom vendors, you can list AdShift there, and name it in your privacy notice.
It shows no consent screen of its own. It reads the IAB TCF v2.2 and GPP strings your CMP writes, once you enable that in code, or takes the answer you pass in. For a user under GDPR, advertising identifiers are sent only when storage and use of data for advertising are both allowed. On iOS the IDFA is read only after the user allows tracking in Apple's prompt, which your app shows.
Not on the Free and Growth plans. The Terms of Use promise commercially reasonable efforts and no uptime figure. On the Enterprise plan, service levels are agreed in your contract, including what happens when data is delayed or lost.
No. AdShift does not hold SOC 2 or ISO 27001 certification today.
SSO is not available yet. Today sign-in is by email and password or with Google; there is no customer-facing audit log and no second sign-in factor for email-and-password accounts. Roles and permissions, including custom roles, are available.
The user contacts you, the controller. Send the request to privacy@adshift.com and we act on your instruction. We can also switch off measurement for a single device from our servers; the SDK then stops sending data from that device until the app is reinstalled.
Check AdShift on your own traffic
Start free with 12,000 attributed installs in your first year, or book a demo and we will go through your setup together.
12,000 attributed installs free in your first year. No card.