Trust

Reversible. Auditable. Bounded.

The three things a reviewer will check before they sign off on autonomous spend — every move reversible, every move logged, every connection enumerated.

Reversible ledger · every move logged
Zero model training on account data

Reversibility

Reversible by design.

Reversibility is a design constraint, not a feature flag. The same table that the agent writes is the one a reviewer has to be able to walk backward through. If a shift turns out wrong at 11pm, the operator pulls it back without unwinding the rest of the day.

One click to undo any move.
  • Every reallocation in the ledger is reversible — one click undoes the move.
  • Reversal writes a new REVERSAL row that cites the original by id.
  • The original is marked rolledBackAt so dependent entries stay consistent.
  • Reversal is scoped — only that row changes; the rest of the day stays intact.
What a reversal row records.

The same fields finance will see in the CSV export — written verbatim to the ledger when an operator pulls a reversal:

kind:        REVERSAL
of:          <original-externalId>
by:          <operator>
at:          <ISO-8601 timestamp>
reason:      <free text, 1–500 chars>
channel:     <GOOGLE | META | TIKTOK>
amount:      <cents, mirrored from original>
rolledBackAt: <set on the original row>
CSV export of the entire ledger
  • Every row carries timestamp, channel, campaign, action, amount, reason, status.
  • Streams as RFC 4180 CSV — finance can SUM, filter, and pivot in any spreadsheet.
  • Respects the same date and channel filters as the in-app /audit view.
  • Reversals are emitted as their own REVERSAL rows, not edits to the original.

Download the CSV from the live export button on /audit.

Dated digest, reason notes required
  • Daily digest summarises the prior UTC day and is delivered on a fixed schedule.
  • Same row format as the CSV export — finance and the operator read the same fields.
  • A reversal row is only written after a typed reason is captured from the operator.
  • Reasons are first-class field values, not free-text comments in a side-channel.

The emailed digest lives at /digest. Reversals are gated on a non-empty reason before any row is written.

Both surfaces read from the same Prisma store as the in-app /audit view — they cannot drift.

Data posture

Data we touch, and data we don't.

The same channels a performance marketer logs into, and nothing else. No scraping, no enrichment, no cross-customer pooling.

What we read
  • Google Ads — campaigns, ad-sets, creatives, and the metrics those endpoints expose.
  • Meta Ads — the same shape: campaign-level spend, conversion, and auction signals.
  • TikTok Ads — same again, for the accounts you connect.
  • Only the metrics the platform publishes: impressions, clicks, conversions, spend.
What we won't do with it
  • No third-party account access beyond the platforms the operator connects.
  • We never read accounts the operator has not authorised via OAuth.
  • Account data is never used to train models, never sold, never shared with other customers.
  • Reversible ledger with 90-day retention on Solo and 2-year retention on Team — the same horizon finance reviews against.

Two minutes to read. One conversation to sign off.

If you'd like a live walk-through of the ledger with our team, write to us.

See how the loop runsSee the plans