Security, Privacy, and Compliance at Metadata

A security-first mindset that’s rooted in our core value of trust.

Security, Trust, Privacy

These are the foundational principles the Metadata platform was created from and the principles throughout every aspect of our business. Metadata has engaged independent experts and third parties to verify our security, privacy, and compliance controls, and has achieved related certifications.

Stringent Security Controls

Metadata continuously monitors 100+ security controls across the organization using its own automation platform. Automated alerts and evidence collection allows Metadata to confidently prove its security and compliance posture any day of the year, while fostering a security-first mindset and culture of compliance across the organization.

3rd Party Penetration Testing

Metadata completes annual 3rd party penetration tests by a qualified assessor as well as between major feature releases.

Annual Security Training

We’ve partnered with a leading security training company to cover 13 major topics for our employee training.

Phishing Testing

We simulate phishing exercises monthly with all staff using extremely realistics phishing emails.

Secure by Design

We use least privilege when connecting to customers’ environments, scoped to only what’s needed to satisfy the control.

Data Security, Privacy And Compliance​

Being in the security and compliance automation business means holding our own internal programs to the highest of standards. The team at Metadata is committed to achieving and maintaining the trust of our customers, partners, and employees through these efforts. If you have any compliance or privacy questions please contact us at

SOC 2 Type II

Metadata has achieved a SOC 2 Type II attestation from a certified auditor with no exceptions in the final report. We work with an AICPA certified audit firm to evaluate our information security program and controls on an annual basis and continuously monitor those controls using the Metadata platform.

General Data Protection Regulation (GDPR)

At Metadata, we are strong supporters of privacy and we adhere to GDPR and other privacy regulations in everything we do. We as a processor will enter into a data processing addendum (DPA) with our customers that will include standard contractual clauses (“SCC“) around data transfers and data protection. For more information please visit our GDPR page, sub processors page, or to

California Consumer Privacy Act (CCPA)

Metadata will accept any removal request from any location as long as it is a valid request made by a qualified party. If you have a removal request please email


Web Application Firewall

Industry leading Web Application Firewall with automatic updates to block against the latest threats spotted around the world


DNSSEC to block against dns hijacking attacks. We take your access to Metadata seriously and go in-depth, enabling every security measure we can.


TLS 1.2 minimum for data in transit and encryption at rest for all instances and databases.



AWS handles physical and virtual aspects as part of the shared responsibility model. Deployments with AWS Fargate limit our footprint and ensure a better security posture.

Infrastructure as Code

Infrastructure as code with Terraform allows peer reviewed changes, template scanning for vulnerabilities, and quick recovery in case of outages.


Static Code Analysis

Every code merge has a static code analysis check done that must be passed before code can be merged to main.

Third Party Library Scanning

A leading third party security solution scans all of our libraries to ensure we don’t have vulnerable libraries in the code base.

Credential Checking

We scan our codebase for credentials to ensure they aren’t accidentally merged into code.

Peer Reviewed Merges

All code is peer reviewed by a Senior Engineer before being merged to main.


Mobile Device Management

All of our devices are centrally managed with policies around security, patching, and encryption enforced.

Endpoint Detection Response

Metadata uses the latest technology in endpoint security to identify potential threats. We go beyond anti-virus and use EDR to see malicious activating and the chain of events that lead up to it.

Advanced Persistent Threat Detection

There are many threat actors that target specific companies, Metadata combats this by using solution that have ATP protections and have 24/7 managed threat hunting capabilities.

DNS Filtering

We have implemented Advanced DNS Filtering on our endpoints to filter malicious requests that could harm our employees or infrastructure.

Don’t just take our word for it

Quick design & launch of campaigns
Automated optimization & budget shifting. Clear visibility into key metrics & spend. Easy experimentation to help you course-correct quicker.
Tamara T.
Validated reviewer
Mid-Market(51-1000 emp.)
The advertising platform to rule them all!
Metadata has been the most efficient platform for managing LinkedIn and Google ads all in one place. I can easily manage audiences, ads, creatives, offers, and more. The budget grouping allows me to control how much spend to allocate by campaigns, geos, and more.
Verified User in Computer Software
Validated reviewer
Mid-Market(51-1000 emp.)
The ability to launch campaigns simultaneously across LinkedIn, Facebook, and Google Ads is incredible
It saves countless hours of duplicitous work and provides unmatched visibility into the best-performing channels.
Maggie D.
Validated reviewer
Mid-Market(51-1000 emp.)
4.6 based on 274 reviews