Why this exists

Google Ads audits are strange economics. Every agency needs them — for pitches, onboardings, and quarterly reviews — but the tools that automate them are bundled into $100–250/month management suites built for teams running heavy ad spend. Small agencies end up either paying for a suite they use one feature of, or burning senior hours building audit decks by hand. Meanwhile, businesses running their own ads get a choice between free "graders" that exist to book a sales call and agencies that start at $200/month.

Advestigate is the deliberately small answer: the audit engine and the branded report, sold alone, priced for the people who were being skipped — $39–79 for agencies, $25 for self-managed accounts.

How your Google data is handled, in plain English

Advestigate's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Here is what that legalese commits us to, translated:

• Your data is used for your audits, and nothing else. We read Google Ads reporting data solely to generate the audit reports you request. Not for advertising, not for resale, not for training models, not for benchmarking you against other customers.
• No humans read your account data. Processing is automated. The exceptions are the narrow ones the policy itself defines: your explicit consent (e.g., you email us asking to look at a confusing finding together), security investigation, or legal requirement.
• Nothing is transferred. Your Google data isn't sold or given to third parties. It moves only where running the service requires it: our database and our hosting infrastructure.
• Access is read-only and revocable. The product cannot modify your account — we never create, pause, or change campaigns. Disconnecting inside the app revokes the token at Google and deletes it from our systems; you can also revoke from your Google account directly at any time.

The formal version of all of this lives in the privacy policy.

Security posture, honestly stated

We're a small product, and we'd rather describe our security accurately than impressively: OAuth tokens encrypted at rest (AES-256-GCM), TLS everywhere, passwords hashed with scrypt, session cookies HTTP-only and signed, and a product architecture whose most important property is what it lacks — any code path that can write to your ad account. We don't claim certifications we don't hold; if we obtain SOC 2 or similar in the future, it will be stated here with the report available on request.