Markitech / Trust
Security
An AI that works in live ad, analytics and tag accounts has to be safe by design. This is how Markitech is built.
Updated November 4, 2026
Sign-in without passwords
Every platform connects through its own authorization flow. You sign in on Google or Meta directly, and the platform gives Markitech a token limited to the access you approve. Markitech never sees or stores your platform passwords. WordPress connects with an application password, a separate credential you can revoke at any time.
Encrypted credentials
OAuth tokens are encrypted at rest. They stay on Markitech's servers and are used there to call each platform. They are never shown in chat or passed to an AI client.
Approval on every change
Reporting and lookups run freely. Every change to a connected account, such as pausing a campaign, changing a budget or publishing a Tag Manager version, is proposed with the exact account and values and held until a person approves it. The hold is enforced by Markitech's servers, not by instructions to the AI, so it still applies if someone asks the AI to skip it.
A read-only MCP server
Outside AI assistants connect to mcp.markitech.app with OAuth sign-in to your Markitech account and a read-only scope. Through MCP they can read the platforms you connected but cannot change anything.
Least privilege
You choose which accounts and properties to connect during each platform's authorization step. You can disconnect a platform at any time, which deletes its stored token, and you can also revoke access from the platform's own security settings.
Safe testing
The site tracking test loads pages in an isolated browser. Meta Conversions API checks use test events marked with a test event code, so they never count as real conversions.
In transit and payments
Markitech's sites are served only over HTTPS. Payments are handled by Stripe, so card details never reach Markitech's servers.
Report a vulnerability
If you believe you have found a security issue, email joe@redwagon.agency with the details and steps to reproduce it. Please give us reasonable time to fix it before sharing it publicly. Our security contact is also published at /.well-known/security.txt.