Security and data
Your accounts stay yours.
Last updated October 26, 2026 · Sorted Agency LLC
Giving an agency access to your ads, Klaviyo and Shopify is a risk. Shared logins, accounts moved into the agency's name, data exported to places you cannot see. We work the other way: NDA first, named access you control, and a clean handover if you ever leave.
How we handle access
- NDA first
- We sign an NDA before we see a dashboard. Client names never appear in our case studies, posts or sales material.
- Your accounts, your name
- Ad accounts, Shopify, Klaviyo, HubSpot, data and creative stay owned by you. We never move them into ours.
- Nothing to hand over to start
- The audit and the first call use your public store and what you tell us. You give access only when work starts.
- Read-only access first
- We ask for read-only access first and add edit rights only where the work needs them.
- Named-user access
- Every person on your account gets their own login, never a shared password. You can see who has access and remove anyone at any time.
- US hours
- The team works your day, so an access question or a request to remove someone is handled the same day.
- Clean handover
- If you move on, our access is removed within 24 hours and everything we built stays in your accounts: flows, campaigns, audiences, creative and reports.
- Payments
- Card payments on our site go through Stripe, and Razorpay in India. We never see or store card numbers.
What security teams ask us
Who on your team can see our customer data?
Only the specialists assigned to your account, each with their own named login that you control. If someone leaves the account, their access is removed.
Where does your own data live?
Our website runs on Vercel, and form submissions and our internal tools run on Supabase on Amazon Web Services in Mumbai (ap-south-1). Email goes through Amazon SES. Connections are encrypted in transit.
Do you work with CRMs, CDPs and data warehouses?
Yes. We connect Klaviyo and HubSpot to CRMs, CDPs and warehouses through their APIs. We scope which fields move and why before we connect anything.
What contracts can you sign?
An NDA before any access, and for larger brands annual terms with a response SLA. If your legal team needs specific terms, send them over and we will review them.
Your data on this site
We honor Global Privacy Control signals, keep ad pixels off when you decline, and let you delete or download your data in a few clicks. See your privacy choices and our privacy policy. Found a security issue? Email dhiraj@sorted.agency (see our security.txt).