We never ask for your password
Not once, not for setup, not "just to get started". Google Ads, Google Analytics, Merchant Center and Tag Manager all support granting access to a separate account. Any agency asking you to hand over login credentials is asking you to break the security model of your own business.
If you have already given a password to a previous agency: change it, turn on two-step verification, and review the user list on every property.
We ask for the lowest access level that does the job
| What we ask for | Why |
|---|---|
| Standard access to your Google Ads account, or your account linked to our manager account | Enough to build and change campaigns. Not enough to remove you. |
| Read-only Analytics access, unless tracking work requires more | We usually only need to read. Where we need to install tracking we will say so and ask then. |
| Nothing on your website unless it is required | Where a tag has to be installed, we prefer sending you a snippet and instructions over holding credentials to your site. |
You remain the owner or administrator of every property at all times. We will not accept an arrangement where we hold ownership of an account you paid for.
Leaving is a two-minute job
On request, at any time and for any reason, including mid-dispute: we give you your Google Ads customer IDs, unlink our manager account, and confirm removal in writing. There is no handover fee and no period in which you cannot reach your own data.
What Google's own policy entitles you to
These are not our inventions. Google's third-party policy places these obligations on any party managing advertising on your behalf:
- If they charge a management fee separate from the cost of advertising, they must inform new customers in writing before each first sale and disclose the fee's existence on customer invoices.
- They must provide you with the customer IDs for your Google Ads accounts when you request them.
- They must share cost and performance reports in a way that is easy for you to access, or let you sign in to your own account to see that data directly.
- Google requires a separate account for each end-advertiser that a third party manages.
- Where 80% or more of their customers spend under $1,000 USD a month, they must publish a disclosure notice and link it somewhere clearly discoverable, such as the homepage footer.
Ours is linked in the footer of every page on this site: third-party disclosure.
Data handling
- Account access is held by named individuals, not a shared login.
- Two-step verification is enabled on every Google account we use for client work.
- We do not download, store or process your customer lists unless a specific piece of work requires it, and we will agree that in writing first.
- We do not sell, share or repurpose your advertising data. It is used to run your account, nothing else.
- Where we write about our work publicly, no client is identified without written permission.
If something goes wrong
If you believe an account we touch has been compromised, email dat@defio.io with "SECURITY" in the subject line. We will revoke our own access immediately on request, before any discussion about what happened.
This page describes our operating commitments. It is not a certification and we make no claim to hold any security accreditation.