Trust & Governance
AI governance and data protection, built into execution
Concord combines AI interpretation with deterministic infrastructure, human oversight, and scoped access to client data. This page explains how the system is governed.
Architecture
AI interprets. Concord validates and executes.
Users write instructions in natural language. Agents interpret the request and its context. AI models never interact directly with advertising platforms.
Models and agents
Interpret requests · Prepare structured actions · Explain results
Concord execution layer
PermissionsAdvertiser rulesParametersFormatsQuotasPlatform limitsSecurity controls
Advertising platforms
Direct API integrations only
Structured actions pass through the execution layer. Only operations that pass every check reach a connected platform.
Human oversight
Human approval by design
Significant campaign actions require approval by an authorized user: campaign creation or launch, budget changes, targeting or audience changes, creative changes, and other significant changes to configuration, delivery, or campaign status.
Prepared
The action is prepared as a structured, reviewable operation with its full parameters.
Reviewed
An authorized user examines what will change, where, and why.
Modified, approved, or rejected
The reviewer can adjust the action, approve it, or reject it.
Executed
Only then is the operation sent to the advertising platform, through the execution layer.
Data protection
Your data stays yours
Client data is never used to train models. It is not shared between clients. These are properties of the architecture, not promises in a policy. Model providers are selected per request under the same rules, and none trains on client data.
- SOC 2 Type IICertified
- GDPRCompliant
No model training
Client data is never used to train, improve, or fine-tune any model
Client isolation
Client data is never shared between clients or used to answer another workspace
Rights enforced outside models
Access is applied by the infrastructure, and only the context a request needs is loaded
GDPR compliant
Minimisation, isolation, and scoped access, by design
Traceability
Every action is traceable
The audit history can record the original request, the user, the proposed action and its parameters, Concord's checks, the approval, modification or rejection, the operation sent to the platform, the platform's response, and the date and time of each stage.
Shared Chats
Recent Chats
History
Recap of the action groups submitted to the platforms for Northlane Media.
| Advertiser | Campaign | User | Created | Updated | Submitted | ||
|---|---|---|---|---|---|---|---|
 |  IKEA | IKEA_FR_Spring_Display_Awareness | Camille Laurent | 24 | 0 | 17 Jul, 14:49 | |
 |  Nike | Nike_AirMax_Summer_Video |  Jonas Meier | 0 | 8 | 17 Jul, 10:02 | |
|  L'Oréal Paris | Loreal_Glow_Q3_YouTube |  Ana Duarte | 13 | 0 | 16 Jul, 13:21 | |
| IKEA | IKEA_Always_On_Display | Camille Laurent | 0 | 1 | 16 Jul, 09:26 | |
 |  Samsung | Samsung_Galaxy_Launch_Reach | Jonas Meier | 29 | 0 | 15 Jul, 13:04 | |
| IKEA | IKEA_Spring_Social_Prospecting | Ana Duarte | 2 | 0 | 15 Jul, 12:53 |
Technology relationships
Official partners
Two different proofs: the platforms Concord operates through direct integrations, and the official statuses granted by the platforms themselves.
Connected advertising platforms
Operated through purpose-built tools and direct API integrations.
Official technology partners
Concord is certified by the advertising platforms it builds on.
Meta Tech Provider
Google Partner
TikTok Marketing Partner
Snap Partner
Amazon Ads Verified Partner
Questions
Questions about governance and data
Is client data used to train AI models?
- No. Client data is never used to train, improve, or fine-tune any model, and it is never shared between clients.
Do AI models act on our ad accounts?
- No. AI models never interact directly with advertising platforms. Agents interpret the request; Concord validates and executes it.
Which actions need human approval?
- Significant campaign actions require approval by an authorized user: campaign creation or launch, budget changes, targeting or audience changes, creative changes, and other significant changes to configuration, delivery, or campaign status.
Is Concord SOC 2 certified and GDPR compliant?
- Concord is SOC 2 Type II certified and GDPR compliant.
Do we have to share our ad account passwords?
- No. Each member connects their own advertising platform accounts through the platform's own sign-in, and an admin decides which advertisers and accounts are in scope. Concord acts only on accounts in scope that the member's own connection reaches, and a connection can be removed at any time.
Where is our data hosted?
- In the European Union, on Amazon Web Services (AWS).
Are competing clients kept apart?
- Yes. Client data is never shared between clients or used to answer another workspace, and memory follows each workspace's permissions.
Can we audit what Concord did?
- Yes. The audit history can record the original request, the user, the proposed action and its parameters, Concord's checks, the approval, the operation sent to the platform, the platform's response, and the date and time of each step.
Request the complete governance documentation, or talk to the team.