For the compliance officer
Autonomous spend with a paper trail finance will sign off on.
Plumbmark is the autonomous cross-channel ad buyer you sign off on — because every move it writes is one click from being reversed, every row is timestamped at write time, and the same ledger streams as a finance-grade CSV. Four questions drive this page: is the change reversible? is its history auditable? what data does Plumbmark store? and what does it deliberately not do with that data?
Reversibility
Reversible by default.
Reversibility is a design constraint, not a feature flag — the same table the agent writes is the one a reviewer walks backward through. If a shift turns out wrong at 11pm, the operator pulls it back from the audit view without unwinding the rest of the day.
- Every reallocation is one click from being undone — the operator pulls it back from the audit view.
- Reversal writes a new REVERSAL row that cites the original by id; the original is marked rolledBackAt.
- Reversal is scoped — only that row changes; the rest of the day stays intact for finance to attest.
- Reversal is idempotent — a duplicate POST cannot overwrite the originally-recorded reason.
The live reverse action lives on the audit view — every row carries its own undo button, gated on a non-empty reason.
The same fields finance will see in the CSV export — written verbatim to the ledger when an operator pulls a reversal:
kind: REVERSAL
of: <original-externalId>
by: <operator>
at: <ISO-8601 timestamp>
reason: <free text, 1–500 chars>
channel: <GOOGLE | META | TIKTOK>
amount: <cents, mirrored from original>
rolledBackAt: <set on the original row>Auditability
An auditable ledger — RFC 4180 CSV, finance-ready.
Every move lands on a row finance can plug into a spreadsheet. One row per move, one timestamp per row, no batching, no side channels. The same store the on-screen audit view reads is the store the CSV export streams from — they cannot drift.
- One row per move — no batching, no side-channels, no log files outside the ledger.
- Every row carries an ISO-8601 timestamp at write time, not at batch-flush time.
- RFC 4180 CSV export streams from the same store as the on-screen /audit view — they cannot drift.
- Reason is a first-class field. Reversal rows are only written after a non-empty reason is captured.
Open the live ledger at /audit; the broader assurance surface — reversibility, finance-grade CSV, bounded access — is at /trust.
timestamp | channel | campaign | direction | reason
----------------------+---------+----------------------------------------+-----------+------------------------------------------------
2026-07-14T14:30:02Z | META | Spring Lookalike — US → Spring L… DE | +$420.00 | DE lookalike ROAS lifted above floor for 3 cy…
2026-07-14T15:00:11Z | GOOGLE | Brand Search → Brand Search (floor) | +$180.00 | Floor ROAS breach — bid adjustment held spend…
2026-07-14T15:15:44Z | TIKTOK | Retargeting EU → paused | -$310.00 | Retargeting EU ROAS below floor — paused unde…The on-screen preview mirrors the columns the live CSV stream emits — one row per move, no formatting that would stop a spreadsheet from parsing the cell.
Data handling
What we store, and what we deliberately don't.
Three things live in the platform — settings, the ledger, and the OAuth tokens needed to act on the platforms you connect. Everything else is off-limits, by design.
Settings
Your policy file (floor ROAS, daily-change ceiling, allowed channels, blocked audiences) — the rails the agent runs inside.
Ledger
Every reallocation the agent writes and every reversal the operator pulls — timestamp, channel, amount, reason, status. The same store the CSV export streams from.
OAuth tokens
For the ad platforms you connect, the bare-minimum scopes needed to read spend and post bid adjustments. We never read accounts you have not authorised.
Plumbmark never scrapes ad creative — copy, image, or video — from any platform.
- No cross-customer pooling. Your data is never used for another tenant, ever.
- No selling. Account data is never sold, never shared with third parties.
- No model training on account data. The agent never trains on what your spend taught it.
- No reads beyond the platforms you connected. We never access an account you have not authorised via OAuth.
The broader data posture — what we read off the platforms, the retention horizon on the ledger — is on /trust.
Join the security waitlist
Two minutes to read. One briefing to send.
Drop your email and Plumbmark will write back with the compliance briefing — the schema, the CSV column map, and the SSO/audit options finance usually asks for before they sign off.