1. A separate private workspace
Enterprise is hosted separately from the consumer Addictd product. Client sign-in, workspace data, and the Google connection stay inside the Enterprise environment and are not available to the consumer product. One client organization does not gain access to another organization's workspace.
2. Invitation-only access
There is no public sign-up. Invited users sign in to the organization that invited them, and owner, administrator, analyst, and viewer roles limit what each person can do. Access is checked from the signed-in account on every protected request. Removing a person from the team removes that organization access immediately.
3. Read-only Google access
The YouTube connection requests only the account identity, email, YouTube, and YouTube Analytics access needed to read the connected channel. Addictd Enterprise cannot publish, edit, rate, comment on, or delete anything on that YouTube channel.
Google credentials are encrypted and are not available to the browser. An organization owner or administrator can disconnect YouTube from Settings. Disconnecting asks Google to revoke access and removes the local connection and imported data; it does not change or delete anything on YouTube itself.
4. Protecting client data
Protected requests check both the signed-in user and the client organization before returning workspace data. Google credentials and other secret values are never included in client pages or support records. Video metrics and retention data are shown as received from YouTube; if data is not available, the workspace says so instead of inventing a value.
5. Automatic YouTube updates
After YouTube is connected, the video catalog, current metrics, and available retention data update automatically. Manual refresh is a secondary recovery option when a recent video or retention curve has not appeared yet. If Google access expires or is revoked, the workspace asks an owner or administrator to reconnect instead of continuing silently.
6. Connection and engagement deletion
If Google access is revoked or becomes invalid, related Google data is removed as soon as possible and within seven calendar days. An in-app disconnect removes the local connection and imported data after asking Google to revoke access.
When Addictd closes an engagement, it becomes read-only immediately and shows its content deletion deadline. The client can continue to read its video analysis, delivered report, and advisory history until that date. By the shown deadline, the engagement's delivered report, advisory history, and engagement-specific access records are deleted. This does not delete the organization, team memberships, sign-in accounts, the YouTube channel, or unrelated YouTube data.
7. Security records and service status
Security records exclude Google credentials, encryption keys, and raw client data. The workspace shows a clear connection or delivery status when an action needs attention so a failed action does not appear complete.
8. Client responsibilities
Clients should invite only authorized representatives, protect their Google and Enterprise accounts, assign the least role each person needs, review connected applications, and promptly disconnect or notify us when an account, employee, or engagement should no longer have access. Do not send passwords, tokens, private keys, or other secrets through support email.
9. Reporting a security concern
Send suspected vulnerabilities or incidents tosupport@addictd.aiwith “Enterprise security” in the subject. Include the affected URL, time, and a concise description, but do not include live credentials or client data. We will triage the report and coordinate next steps. This page describes current controls; it is not a claim of a certification or third-party audit that has not been completed.