AdScriptly
Documentation>Security & Privacy Considerations
Critical Knowledge

Security & Privacy Considerations

Essential guidelines for keeping your Google Ads account secure while automating with scripts and managing permissions properly.

10 minutes
Critical Security Rules

🚫 Never Share Scripts with Credentials

Scripts run with your account permissions. Never share scripts containing API keys, passwords, or sensitive configuration.

// ❌ BAD: Hardcoded credentials
const API_KEY = "your_secret_key_here";
const PASSWORD = "password123";

🔒 Limit Script Permissions

Only grant minimum necessary permissions. Use preview mode for testing and limit script access to specific campaigns when possible.

  • • Test scripts in preview mode first
  • • Start with read-only operations
  • • Limit campaigns using .withCondition()
  • • Set reasonable budget/bid limits
Access Control
  • Minimum required permissions
  • Regular permission audits
  • Account-level restrictions
  • Time-based access limits
Monitoring
  • Script execution logs
  • Change notifications
  • Unusual activity alerts
  • Regular audit trails
Data Protection
  • No sensitive data in logs
  • Secure external connections
  • Data retention policies
  • Compliance with regulations
Safe Coding Practices

❌ Security Risks

// BAD: Hardcoded sensitive data
const SHEET_URL = "https://docs.google.com/...";
const API_SECRET = "sk_live_abc123...";

// BAD: No validation or limits
function setBudget(campaign, amount) {
  campaign.setBudget(amount); // No limits!
}

// BAD: Logging sensitive data
Logger.log("User email: " + userEmail);

✅ Secure Approach

// GOOD: Use PropertiesService
const SHEET_URL = PropertiesService
  .getScriptProperties()
  .getProperty('SHEET_URL');

// GOOD: Validation and limits
function setBudget(campaign, amount) {
  const MAX_BUDGET = 10000;
  const validAmount = Math.min(amount, MAX_BUDGET);
  campaign.setBudget(validAmount);
}

// GOOD: No sensitive data in logs
Logger.log("Budget updated successfully");

🛡️ Security Checklist

  • ✅ Use PropertiesService for configuration
  • ✅ Validate all input parameters
  • ✅ Set maximum limits on changes
  • ✅ Use preview mode for testing
  • ✅ Never log sensitive information
  • ✅ Regular code reviews
  • ✅ Monitor script execution
  • ✅ Update dependencies regularly
Account Permission Management

📋 Permission Levels

Read-Only
  • • View campaign data
  • • Generate reports
  • • Monitor performance
  • • Audit activities
Standard
  • • Modify bids and budgets
  • • Pause/enable campaigns
  • • Add keywords
  • • Update ad copy
Admin
  • • Account-level changes
  • • User management
  • • Billing access
  • • API configuration

⚠️ Best Practices for Teams

  • • Grant minimum required permissions to each team member
  • • Use separate accounts for different environments (dev/staging/prod)
  • • Regularly review and audit user permissions
  • • Implement approval workflows for critical changes
  • • Document who has access to what and why
  • • Set up alerts for unauthorized access attempts
Data Privacy & Compliance

🔒 Data Handling

  • • Never store personal user data in scripts
  • • Use aggregated data only
  • • Implement data retention policies
  • • Secure data transmission (HTTPS)
  • • Regular data cleanup procedures

📋 Compliance

  • • Follow Google Ads API policies
  • • Comply with GDPR/CCPA requirements
  • • Maintain audit trails
  • • Document data processing activities
  • • Regular compliance reviews

📝 Documentation Requirements

Maintain comprehensive documentation for all scripts and automation processes:

  • • Purpose and functionality of each script
  • • Data sources and processing methods
  • • Permission requirements and access controls
  • • Change logs and version control
  • • Incident response procedures
Performance OptimizationTesting & Debugging