Security and data handling

This page says, in plain words, how Probative handles your firm’s data and the accounts we work in. It is not a certification. We don’t hold a SOC 2 report or any other audit report, and we don’t imply one. Where a statement here is a commitment in a contract, we say so.

Your firm owns the accounts

• Your name, your card. Your Google Ads, Local Services Ads, Google Analytics, Search Console, Business Profile, call-tracking account and website host belong to your firm. Each one is opened in the firm’s name and paid for with the firm’s own payment method.
• We are a user, not the owner. You can remove our access in each account at any time, without asking us.
• We hold nothing in our own name for you. We don’t open an account, buy a domain or keep a phone number for your firm in Probative’s name.
• A checklist at the start, an exit kit at the end. We list every account with who owns it and whether you could remove us today. If you leave, we remove ourselves from your accounts and hand over the records. See how we work and our terms in plain English.

We ask for the least access that does the job

• Read-only first. Reviews and studies run on read-only access.
• Standard access to manage. Running campaigns needs standard access. We ask for admin rights only for a one-time step, such as linking two accounts or setting up conversion tracking, and then we step down.
• No billing access. We never need your payment details and never handle your ad money. You pay each platform directly.
• One person, one login, and a second factor. Our team does not share logins. Sign-in to our own staff pages uses a passkey or an authenticator-app code, not just a password.
• A short list. We keep a list of who on our team can reach your accounts, and we remove anyone who stops working on your firm.

What we store, and for how long

We collect little. Our request forms take a name, work email, firm, website, state, practice area and a short message. We ask you not to send details of anyone’s legal matter, and our forms are not built for it.

• Form requests and the emails about them: kept 24 months after our last contact with you, or less if you ask. After that we erase personal details and keep only a scrambled copy of the email address so we can still honor an opt-out.
• Form security data (a scrambled copy of an IP address and a browser description): deleted after 30 days.
• Follow-up emails: after a request form we may send a short series, no more than one email every three days. It stops when you reply, become a client or unsubscribe, and a one-click link in every email ends it for good.
• Newsletter sign-ups: kept while you are subscribed. If you unsubscribe, we keep only a scrambled copy of your email so we don’t write again.
• Work for clients: reports and records are kept for the length of the work and a short exit period, then deleted. Details are in the data terms we sign with each client.

The full list is in the privacy policy, which controls if the two ever differ.

Encryption, backups and our systems

• Encryption in transit. Every page and form on probativegrowth.com is served over HTTPS, and our systems talk to each other over encrypted connections.
• Where data sits. The site and its form database run on Cloudflare. Our request-tracking database runs on Supabase. Email goes through Google Workspace. Each is named in the privacy policy as a service provider.
• Backups. Our form database and our request-tracking database are each exported nightly into an encrypted file, kept for 30 days. Client data that lives in a client’s own accounts stays in those accounts, and the platforms that host them keep their own backups.
• Staff pages are locked. Our admin pages return a not-found page to anyone not signed in, lock out repeated failed sign-ins, and record each view and export in a log that can’t be edited.
• No payment cards. We don’t take card numbers on this site.

Conversion uploads are hashed, not anonymous

To teach Google, Microsoft and Meta which ads bring signed clients, a firm can send them a result such as “this call became a signed case”. That upload carries the ad click identifier, and it can also carry the lead’s email address and phone number as a hash.

• What a hash is. A hash is a one-way scramble of the email or phone number, made with SHA-256 (Google). The platform can’t read the original from it.
• What a hash is not. It is not anonymous. A platform that already holds the same email address can scramble it the same way and find a match. That match is the whole point of the upload, and under some privacy laws it counts as sharing personal information. This is why we describe it as “hashed” and never as “anonymous”.
• What we never send. Names, messages, case details or an email or phone number in readable form.
• Less for sensitive practice areas. In client accounts, immigration, family, criminal defense, bankruptcy and disability matters go up with the click identifier only, with no hashed email or phone. On our own site, the same rule applies to requests about immigration, family and criminal defense. A person who opts out, by email or with Global Privacy Control, gets the same treatment.
• The firm decides. For client accounts, hashed contact details go only where the firm and its attorneys have agreed the platform’s policy fits. Our own site’s version of this is in the privacy policy.

We don’t sell data

We never sell personal information. We don’t build audiences from any firm’s client list. Aggregate data we publish is separate and described on our data pages.

AI tools

Our team uses AI tools under business terms that bar training on our data. No firm data goes into a consumer AI tool or a personal AI account. A person reviews everything before it goes out, and no AI tool holds a login that can post, pay or change anything in your accounts.

If something goes wrong

• Report a problem. Email hello@probativegrowth.com, or privacy@probativegrowth.com for a privacy request. Our security.txt lists the same contact. A person reads it and replies within one business day.
• If your data is affected. In our standard client terms, we tell your firm’s named incident contact by phone and email within 48 hours after we confirm an incident, say what happened and what we did, and send a written review after we contain it. Your firm decides whether to notify anyone else.
• Found a weakness? If you find a weakness in this site, please tell us at the same address before you tell others, and please don’t open anyone else’s data.

For reporters

Questions about how we handle data, for a story, go to the media contact in our press kit.

What this page is not

It is not legal advice or a guarantee that nothing will ever go wrong. No system is perfectly secure. Probative is a marketing firm, not a law firm, and the contract we sign with a client controls over this page.

If your firm sends vendors a security questionnaire, send it to hello@probativegrowth.com and we’ll answer it. For reference, the NIST small-business cybersecurity guidance is the framework we follow.