Security at Tech Orbit
Last updated: June 30, 2026
Tech Orbit was founded in Dhaka, Bangladesh in 2024 by a team of media buyers and performance marketers who manage advertising spend and ad account access on behalf of clients every day. Because our work depends on trusted access to client ad accounts and tracking systems, security is a discipline we take seriously in everything we do.
This page summarizes the controls, practices and commitments that protect client data and ad account access on the Tech Orbit platform. It is intended as a plain-language reference for clients and security reviewers. A detailed security questionnaire is available on request.
Company posture
Tech Orbit is a Bangladesh company headquartered at 31/3 West Senpara Parbata, Mirpur Model, Dhaka-1216, Bangladesh. The platform and campaign management work is handled by a small, dedicated team — we do not hand off client ad account access to outside freelancers. Every team member with access to client ad accounts or tracking systems follows internal security practices and receives periodic security training.
Encryption
All client data is encrypted in transit using TLS 1.3 with modern cipher suites, and at rest using AES-256. Database backups, object storage and log archives are encrypted with keys managed in a hardware-backed key management service. TLS certificates rotate automatically and we enforce HSTS across all client-facing domains.
Application security
Tech Orbit's platform is developed against the OWASP Top 10 control set. Every change is reviewed by a second team member, scanned for known vulnerable dependencies and checked before it reaches production. We periodically review the platform's trust boundary as our tooling grows.
Infrastructure and data isolation
The platform runs on hardened cloud infrastructure. Client account metadata, campaign data and reporting live in encrypted Postgres with row-level security policies enforced at the database layer, so a workspace can only ever read its own data. Production environments are logically separated from staging and development, with no shared credentials or data between them.
Ad account access control
Access to client Meta Business Manager, TikTok Ads Manager, Taboola and Google Ads accounts is granted through each platform's own partner-access controls, limited to the named team members working on that account, and reviewed regularly. We do not share client ad account credentials outside the assigned team, and access is revoked promptly when an engagement ends.
Data handling
We do not sell client campaign data, audience lists or tracking data to any third party. Data collected through pixels and conversion tracking is used solely to optimise and report on the campaigns we manage for that client.
Monitoring and incident response
We monitor account activity, spend anomalies and authentication events. Our incident response process defines who is notified, how quickly, and what remediation steps follow. In the event of a confirmed security incident affecting client data or ad account access, Tech Orbit will notify affected clients without undue delay and in accordance with applicable law.
Compliance posture
We process personal data in a manner consistent with applicable data protection principles, including the GDPR where relevant to clients in that jurisdiction, and we will sign a data processing agreement with clients on request. We treat the security practices on this page as ongoing commitments rather than formal certifications.
Reporting a vulnerability
We welcome reports from the security research community. If you believe you have discovered a vulnerability, please email security@techorbitbd.com with a clear description and steps to reproduce. We will acknowledge receipt within two business days and work with you in good faith on a coordinated disclosure timeline.
Contact
For security questionnaires, our data processing agreement or any other security enquiry, write to contact@techorbitbd.com.