Security
Security is a launch requirement, not an afterthought.
Launch connects to systems that hold real customer and business data — analytics accounts, CRMs, ad platforms, commerce data. We built the product with that responsibility in mind from the first integration, not as something to retrofit later.
How we think about access
Scan’s initial scan requires no access at all. A first scan reads what’s publicly visible on a domain — no login, no API key, no credentials exchanged. You can see what Launch finds before you connect anything.
Connected integrations use scoped, revocable access. When you connect a system like GA4, Google Ads, or HubSpot, Launch requests the minimum access needed to discover and check that system — not broad account control. Access can be revoked at any time from within the connected platform or your Launch account.
Every connection is logged. Because Launch’s core value is a record of what changed and who approved it, that same discipline applies to access itself: what’s connected, when, and by whom is part of the record, not a black box.
Data handling
Customer data is encrypted in transit and at rest.
Data pulled from connected systems is used to power Scan and Preflight for your account — it is not used to train models on behalf of other customers, and it is not sold or shared with third parties for marketing purposes.
Data retention and deletion practices are detailed in our Privacy Policy and available in full on request during a security review.
For teams running a vendor security review
We know most B2B buyers need to run Launch through procurement and security review before rolling it out further. We’re an early-stage company and are upfront about that: some formal certifications (SOC 2, for example) are on our roadmap rather than complete today. If you need a completed security questionnaire, a DPA, or a call with our team to walk through our architecture, get in touch and we’ll work through it directly rather than asking you to take marketing copy on faith.
Get in touch