Security

• Passwordless sign-in. There are no passwords to leak or reuse. Sign-in uses one-time codes sent to your verified email.
• Two-factor authentication. Optional TOTP 2FA (authenticator apps) with backup codes, enrolled from Settings.
• Sessions use httpOnly cookies bound to the host you signed in on (our canonical app origin, or an agency partner host).

All payments run through Stripe. Card numbers never touch Waverunner’s servers; we store only Stripe’s references. Wallet accounting is double-entry and idempotent: a campaign day can never be charged twice, and every movement is visible in your ledger.

• PII hashing. Emails and IP addresses captured by the tracking tag are hashed with a salt before storage; raw identifiers are never written to the database.
• Tenant isolation. Every piece of data belongs to exactly one organization. Users may belong to several organizations; each request runs in the active organization context, and every query is scoped to it.
• Encryption in transit. All traffic is served over TLS, fronted by Cloudflare.

API keys are organization-scoped bearer tokens with enforced rate limits (120 reads/minute, 30 writes/minute, export 5/hour). Keys can be revoked instantly from Settings.

Waverunner runs on Fly.io with Postgres hosted by Neon, Cloudflare for DNS/CDN/DDoS protection, and continuous error monitoring. Deploys are automated from CI, and a failing build never reaches production.

Found a vulnerability? Email support@adwave.com with details and steps to reproduce. We investigate every report and appreciate coordinated disclosure.