Read-only by design.

Read-only keys, checked on save

Glow asks for the narrowest credential each provider offers: a Stripe restricted key with Read permissions, Google’s webmasters.readonly and analytics.readonly scopes, a Cloudflare token with only Read groups. When you save a key, Glow checks it: it reads what it needs, then tries writes that can’t succeed. If a write gets anything but “permission denied”, the key is refused and you get the fix.

Where a provider has no read-only option (OpenRouter’s management key, Google Ads), Glow says so plainly, marks the connection “not read-only”, and its outbound network rules allow only the exact GET endpoints it needs.

Sealed the moment it’s saved

Keys are encrypted with envelope encryption: a fresh data key per credential, wrapped by a key pair. The server that faces the internet holds only the public half, so it can seal a key but can’t open one, even if something went badly wrong there. Only the background job worker, which has no public routes, can decrypt, and only for the duration of a sync or an agent run you approved.

Never shown again

After you save a key, nobody can read it back: not a teammate, not our support, not you. Glow shows the last four characters so you can tell keys apart. To change one, replace it.

A second factor, required

Sign in with a phone code, Google or Apple, then confirm with a passkey or Face ID (or an authenticator code if your device has no biometrics). There’s no way to see your numbers with one factor. Sign-ins, new factors and member changes are recorded in an audit log.

Face ID when it opens

Glow locks like a banking app: Face ID or your passcode when it opens and when you come back after a minute away, and your numbers are hidden in the app switcher.

Less data, and it expires

Glow stores aggregates (revenue per day, spend per model), not your customers. It asks Stripe for no customer permission at all. Every row Glow stores carries an expiry date and a nightly job deletes what’s past it. Delete your account and everything goes with it.

AI that doesn’t keep your data

Reports, nuggets and Ask Glow run through OpenRouter, routed only to model providers that commit to zero data retention and no training on your data. Ask Glow is stateless on our side: conversations aren’t stored, only their cost.

Agents need your yes

An agent runs only what you approved: the executor, destination, prompt, schedule and budget are fingerprinted at approval, and any change sends it back to you. Spend caps are reserved before a run starts. Webhook URLs and executor keys are sealed like any other key.

Analytics without your numbers

Product analytics never contain amounts, names, emails, key names or anything you typed: only event names and small codes. This website uses GA4 and PostHog; the app sends nothing to Google.

Report a vulnerability

Email security@meetglow.ai. We reply within two business days, never take legal action against good-faith research, and credit you if you’d like.