Security & Data Handling
How Efficiency Engine handles agency access, client information and automation systems—from initial discovery through to deployment, handover and ongoing support.
Our approach
Efficiency Engine builds reporting, monitoring and workflow systems for digital agencies and performance teams. This work can involve access to advertising platforms, analytics accounts, reporting data, spreadsheets, forms and other operational systems.
Access and data handling are therefore treated as part of the system design—not as an afterthought. Every project should have a defined purpose, agreed access requirements and a clear understanding of what the system will do.
Purpose defined
Access is connected to a specific, agreed project requirement.
Access limited
Permissions are limited to what is required to perform the work.
Controls documented
Important dependencies, approvals and ownership are defined upfront.
Access removable
Client-controlled access can be revoked whenever it is no longer required.
Access and permissions
Efficiency Engine uses the minimum level of access needed to design, build, test or maintain an agreed system.
Named-user access
Individual user access is preferred over shared team logins.
OAuth and service accounts
Platform-approved authentication is preferred over sharing passwords.
Minimum permissions
Read-only access is used when editing or administrative control is unnecessary.
Revocable access
Clients remain able to review, reduce or revoke access permissions.
Clients should not send passwords through ordinary email. Where shared credentials cannot be avoided, an agreed secure method should be used and the credentials changed when the engagement ends.
Client data
Client information is used only for the agreed project, support arrangement or related professional service.
Data minimisation
Systems process only the information needed to produce the agreed outcome.
Client separation
Files, accounts and workflows are kept logically separated between clients.
No cross-client reuse
Confidential data is not repurposed, shared or used to benefit another client.
Controlled demonstrations
Examples are anonymised, redacted or used with appropriate permission.
Confidentiality
Agency operations, client accounts, performance data, commercial information, workflows and internal documentation are treated as confidential.
Information is not disclosed publicly or to another client without authorisation. This includes information visible within advertising platforms, analytics properties, dashboards, reporting systems and internal processes.
Efficiency Engine can work under a non-disclosure agreement or data-processing agreement where the project requires one.
Testimonials, screenshots and case-study materials are published only in a form that respects the agreed level of client confidentiality.
Storage and retention
The location and duration of data storage depend on the system being built and the platforms selected for the project.
Necessary information only
Unnecessary exports, duplicates and temporary data are avoided.
Controlled access
Project information is restricted to those who need it for the agreed work.
Defined retention
Temporary files and exports are removed when they are no longer required.
End-of-project review
Access, files and ongoing dependencies are reviewed at handover or termination.
Where a client requires a particular retention period, storage location or deletion process, this should be agreed before implementation.
Automation safeguards
Automation should reduce repetitive effort without removing the controls needed to protect campaign performance, client relationships or business-critical decisions.
Inputs, outputs, permissions and approval points are agreed.
Logic and outputs are checked before live deployment.
Human approval remains where actions carry meaningful consequences.
Failures and incomplete runs can be surfaced for investigation.
Human approval
Systems that create recommendations, reports, proposals or campaign actions can retain a human review stage. Fully automated execution is used only where the scope, risk and client approval make it appropriate.
Testing and validation
Workflows are tested against agreed scenarios before deployment. Important outputs should include validation checks appropriate to the system, such as missing-data detection, threshold rules, error notifications or manual sign-off.
Third-party platforms
Efficiency Engine systems may connect approved third-party platforms such as advertising accounts, analytics tools, spreadsheets, automation platforms, communication tools or AI services.
The specific platforms used depend on the project requirements. Clients should be told which material third-party services will receive or process their data as part of the agreed solution.
Purpose-led selection
Tools are chosen according to the workflow, data and required outcome.
Client visibility
Material system dependencies are made clear during project planning.
Account ownership
Client-controlled accounts are preferred where long-term ownership is required.
Platform terms
Third-party services remain subject to their own security and privacy terms.
Ownership and handover
Client data remains the client’s property. Ownership and usage rights for scripts, dashboards, workflows, documentation and other project deliverables are defined in the applicable proposal or service agreement.
The agreed commercial model may provide implementation access, an ongoing managed service or transfer of specified project assets. The intended arrangement should be clear before work begins.
A project handover can include:
System documentation
An explanation of the workflow, dependencies and operating process.
Access review
Confirmation of which permissions should remain, change or be removed.
Ownership confirmation
Clear identification of client-owned and licensed system components.
Support arrangements
Defined responsibility for maintenance, monitoring and future changes.
Incident response
If a suspected security, access or data-handling incident affects a client system, the immediate priority is to contain the issue and protect the affected environment.
Suspend the affected workflow or access route where necessary.
Revoke access or rotate relevant credentials and permissions.
Identify what happened, what was affected and the likely cause.
Implement remedial action and communicate with affected clients.
Procurement support
Agencies with formal supplier requirements can raise security, privacy and data-handling questions during the discovery or procurement process.
Efficiency Engine can review reasonable client requirements and, where appropriate, work under agreed confidentiality terms, a data-processing agreement or defined access policy.
Efficiency Engine does not claim ISO certification, independent security accreditation or controls that have not been formally achieved. Any project-specific security requirement should be confirmed before work is commissioned.
Project-specific requirements come first
This page describes Efficiency Engine’s general operating approach. It does not replace a project-specific security schedule, data-processing agreement, non-disclosure agreement or service contract.
Where a client has stricter requirements, those requirements should be reviewed and agreed as part of the project scope.
Need to discuss security before granting access?
Raise your access, confidentiality or data-handling requirements during the Efficiency Review and they can be built into the proposed system from the start.
