The money rules
Three rules it cannot argue with.
Your money never moves through us
Ad budgets stay entirely in your own platform accounts on your own payment methods. Rumin never holds or moves ad spend. It only issues the platform changes you have authorized.
No unattended spending, ever
Autonomous budget changes are blocked unless you have explicitly set a monthly spending cap, and every change stays inside it. No cap, no unattended spend. There is no product default.
Approval gates it cannot bypass
Deletions, publishing to ad platforms, and outreach emails either require your explicit approval or are queued for it. The agent cannot skip its own gates.
Isolation and audit
And the walls around everything else.
sec-arch · defense in depth · walls 4 · gates 4
The Ledger sees everything · always
Every action recorded with its reasoning, results attached afterwards, misses included.
The exit is never locked · yours
Export everything as JSON anytime. Deleting your workspace removes every row immediately.
First, the perimeter
Abuse controls on every door
Every mutating endpoint is rate-limited per workspace; webhooks authenticate with rotating secrets; all inputs are schema-validated.
Past it, the door
Invitation-only membership
Nobody joins without an invitation from an admin. Invite links are single-use and expire in 7 days.
No passwords to steal
Sign-in is magic-link or one-time code, with Google SSO. We never see or store a password.
Inside, the rooms
The right people, the right powers
Members read and draft. Admins connect channels and approve decisions. Only the owner touches billing, members, and the spending cap.
At the center, the vault
Your data is walled off
Every record is scoped to your workspace and isolation is enforced at the database itself, not just in the application, with automated tests on every change.
Credentials handled properly
Ad-platform OAuth tokens stay server-side, never sent to the browser. Your WordPress password is write-only: no API ever returns it.
your data · everything above stands guard
A short list of vetted providers process data on our behalf, each under contract and, for AI providers, under no-training API terms. The complete list lives in our Privacy Policy.
Security questions
Answered straight
Does Rumin train AI models on my data?
No. Your data is sent to AI providers only to produce your own results (analysis, drafts, reports) under their no-training API terms. Your campaigns, conversions and content are not used to train their models.
Where does my ad spend money flow?
Your ad budgets stay entirely in your own platform accounts (Google, Microsoft, LinkedIn, Meta) on your own payment methods. Rumin never holds or moves ad spend. It only issues the platform API calls you have authorized, inside the cap you set.
What happens to my data if I leave?
Export everything as JSON from Settings at any time. Deleting your workspace removes all rows immediately via database cascade. Trial expiry never deletes anything, it only pauses agent work.