Security

This page describes how we handle access to your systems and the data you share with us. It states only what we can evidence. Where a control is not yet formalised, it says so rather than implying otherwise.

What we hold

CubicGrowth is a marketing services business. We are not a software product and we do not host your customer data. In the normal course of an engagement we hold:

• Contact details for the people we work with at your company
• Delegated access to your marketing accounts, under your ownership
• Reports and audit documents we produce for you
• Correspondence relating to the engagement

We do not take custody of your customer database, payment data or any special category personal data and we would push back on being given it.

Account access

We work through delegated access on accounts you own. That means your Google Ads, Google Analytics, Search Console, Meta Business and Google Business Profile accounts remain in your name, with us added as a user.

This matters for two reasons. If the engagement ends, you keep everything, including the historical data that is genuinely hard to replace. And you can revoke our access yourself, immediately, without asking us.

We ask for the narrowest permission level that lets us do the work. Where a task needs elevated access temporarily, we ask for it, use it and ask you to reduce it again.

Credentials

We ask clients not to send passwords by email or chat. Where a shared credential is genuinely unavoidable, we ask that it be shared through a password manager with a time-limited link.

This website

• Served over HTTPS.
• Statically generated. There is no database, no login and no user content behind this site, which removes most of the attack surface a marketing site normally carries.
• The contact form posts to a third-party form processor. See Data Security for what that means for your submission.
• No payment details are collected on this site.

What we do not claim

We hold no SOC 2 report, no ISO 27001 certification and no other independent security audit. We are not going to imply one with vague language about enterprise-grade security.

If your procurement process requires a certified supplier, tell us early and we will say plainly whether we can meet it rather than wasting your time.

Reporting a problem

If you believe you have found a security issue affecting this site or an account we manage, email contact@cubicgrowth.com with enough detail to reproduce it. We will acknowledge within two business days.

We do not run a paid bug bounty. We will credit you if you want to be credited.