How store keys are handled

Keys are encrypted at rest

Each App Store Connect, Google Play and Apple Search Ads key is encrypted with AES-256-GCM, with a fresh random IV and an authentication tag, under a server secret kept outside the database. A key is decrypted in memory only to call the store, and the full key is never shown back in the app.

Read only by default

• A new store connection is read only. The server refuses any write to a store while publishing is off, whatever the key itself allows.
• Publishing is a separate switch for each store, and each change waits for you to confirm it.
• Apple Search Ads is always read only. RocketASO reads campaigns, search terms and popularity.

The least access that works

• App Store Connect: a key with the Sales role. Apple asks for an Admin key once, to start its analytics reports; after that, Sales can read them.
• Google Play: View app information and download bulk reports, plus View financial data for revenue.
• Apple Search Ads: an API user with the API Account Read Only role. The key pair is made in your browser, and Apple only ever gets the public key.
• Check permissions in Connections shows what each key can do, and changes nothing.

Accounts

• Passwords are stored only as scrypt hashes.
• Two-step sign-in with an authenticator app is available in Settings.
• A sign-in lasts at most seven days.
• Production refuses to start with a default secret, and the development sign-in shortcut is off there.
• The API limits how many requests one client can make in a minute.

Leaving

Disconnect in Connections deletes a stored key. Deleting a workspace or the account removes its apps, reports, keyword history, store keys and members from the live database at once.

Reporting a problem

If you find a security issue, email us with Security in the subject. Please give us a chance to fix it before you share it.

Contact

Email support@rocketaso.com.