Trust Center

01

Who we are and what this covers

Fitr Media is a growth agency working with B2B SaaS companies. Our flagship engagement is the 60-day ad sprint, and we deliver a wider set of services alongside it.

Services

• 60-day ad sprint for SaaS. Our flagship engagement, covering positioning, landing pages, paid acquisition, conversion testing and reporting
• Conversion rate optimization. Testing and iteration on existing funnels and pages
• Landing page design and development. Campaign and offer pages built to convert
• Unlimited Webflow design and development. Ongoing site build, expansion and iteration
• Unlimited Webflow maintenance. Ongoing upkeep, fixes and updates
• Webflow consulting. Advisory on site structure, build approach and workflow

To do any of this we are granted access to systems you already own. This page explains what we access, how that access is controlled, what we do with the data we see, and what happens when the engagement ends.

Fixed and ongoing engagements. Sprint and project work runs to a defined end date, at which point access is handed back. Unlimited Webflow and maintenance engagements are continuous, so access persists for as long as the retainer does. Everything else on this page applies equally to both.

Scope. This covers Fitr Media's own practices. It does not cover the security posture of the platforms you ask us to operate in, such as Meta, Google, or your website host. Those are governed by their own agreements with you.

02

What we access

We work on a least-access basis. We request the narrowest permission that lets us do the job, on your accounts, not ours.

What we do not access, request, or store

• Protected health information. We are not a HIPAA business associate
• Cardholder data or payment credentials
• Customer passwords, or your end users' personal accounts
• Production databases, source code, or infrastructure
• End-user personal data beyond what your analytics and CRM already collect

If a project would require any of the above, we will say so before it starts rather than during it.

03

Access control

• Access is granted to named individual accounts, never shared logins
• Multi-factor authentication is enabled on every account used to reach client systems
• Credentials are stored and shared through Bitwarden, our password manager. They are never sent by email, chat, or task comment
• Access is limited to the people actually staffing your engagement
• We prefer delegated access through your Business Manager, so you can revoke us at any time without losing anything

04

Devices and endpoints

• Devices used for client work run full disk encryption
• Devices are password or biometric locked with automatic screen lock
• Operating systems and browsers are kept on supported, patched versions
• Client work is not performed on shared or public machines

05

Data handling and retention

What we hold. Campaign performance data, landing page content and copy, creative assets, research and messaging documents, meeting recordings and transcripts, and reporting.

Where it lives. In the tools listed under sub-processors, under Fitr Media accounts, plus a local working vault.

How long we keep it. Engagement records are retained after a project ends so work can be resumed or referenced.

Deletion. On written request we will delete the client data we hold, excluding anything required for tax or contractual reasons, and confirm when it is done.

06

Sub-processors

Third-party services that may process client data during an engagement. Each holds its own security posture and terms.

07

Call recording and transcription

Client calls are recorded and transcribed automatically to produce accurate recaps and action items.

• Recording is disclosed at the start of the call and a notetaker bot is visible in the meeting
• If you prefer a call not be recorded, tell us and we will turn it off for that call

08

You own the work

This is a deliberate part of how we operate, and it is a security property as much as a commercial one.

• Ad accounts, pixels, websites, landing pages, tracking and creative are built in your accounts, under your ownership
• At the end of a sprint you hold everything: files, components, access and documentation
• If we stop working together, nothing has to be migrated, recovered or bought back from us

09

Security incidents

Our commitment. If we become aware of an incident affecting your data or the accounts we access on your behalf, we will notify you without undue delay, tell you what we know, and work with you on containment.

Our own response practice. Advertising accounts are a live target for takeover. We treat any anomaly in an ad account, such as unrecognized spend, new users, or changed payment methods, as an incident until proven otherwise: revoke sessions, reset credentials, review the user list, and contact platform support.

10

Starting and ending an engagement

At kickoff. We request only the access needed for the current phase, and document what was granted.

During. Access changes as the engagement moves through phases. If someone leaves the engagement team, their access is removed and the relevant credentials are rotated.

At the end. We ask you to revoke our access, and we remove ourselves from the accounts we can exit on our own. On request we will confirm removal in writing.

11

Compliance posture

We are a small agency and we would rather be accurate than impressive.

• Not SOC 2 certified
• Not ISO 27001 certified
• Not a HIPAA business associate, and we do not process PHI
• No third-party penetration testing, because we do not operate a product or infrastructure that would be its subject

What we do have

• Least access, granted to named accounts
• Multi-factor authentication, with credentials managed in Bitwarden
• Client ownership of all assets we build
• A defined incident response for account compromise

If your security review requires a signed DPA, a questionnaire response, or specific contractual commitments, we will complete them.

12

Contact

Security questions, access issues, or a suspected incident:

Fitr Media Team
support@fitrmedia.com