Hosting + region.
The database, file storage, and authentication system are hosted on Supabase in the ap-southeast-2 region (Sydney). Files (your competitor scrapes and generated variants) stay in that bucket. Cloudflare Workers run our HTTP endpoints globally on Cloudflare's edge — they don't store your data, they pass it through.
Meta access tokens.
When you connect Meta, Mockingbird receives a long-lived access token from Facebook. We encrypt it at rest in Supabase Vault before storing it; the encryption key is held by Supabase's infrastructure, not us. Workers decrypt the token on demand via a service-role-only RPC — never via the browser. Disconnect at any time from Settings → Connections.
The AI pipeline.
Variant generation uses Google's Gemini API on the paid tier. Per Google's paid-tier terms, content sent to the API is not used to train their models or improve their services. The cropped competitor ad image and your brand profile leave Australia to hit the Gemini endpoint, get processed, and come back — they're not retained.
Competitor scraping.
Mockingbird scrapes Meta's public Ad Library — the same ads Meta publishes to the open web for transparency. We don't access anything behind authentication, and we don't pull from individual users' feeds. If you can see the ad on facebook.com/ads/library without logging in, we can see it too.
What we don't claim.
We're not SOC 2 certified, APP-audited, or GDPR-compliant by attestation. Those are real audits that take real time; we'll do them when our customer mix demands them. For now you have an architecture description, an audit trail in Supabase, and a delete-my-data button (email support@mockingbird.digital and we'll do it within 7 days).