We serve ad decisions inside other companies' streaming products. That makes our security posture part of theirs — so here is how we run it, and how to tell us if we have got something wrong.
Every statement on this page must be true on the day it is published, because this is the page a security questionnaire is checked against. Items marked «LIKE THIS» need confirmation from whoever owns the infrastructure — publish only the ones that are actually in place, and delete the rest rather than softening them.
Sections 1 to 3 and section 9 describe controls verified as active on this website's infrastructure. Sections 4 to 8 describe practices that need internal confirmation before they are asserted publicly.
GoGo CTV runs on Amazon Web Services. This website is served as static content from Amazon S3 through the Amazon CloudFront content delivery network, which also absorbs network-layer denial-of-service traffic at the edge. Our platform services run in AWS regions in the United States.
We do not operate our own data centres. Physical and environmental security for the underlying facilities is AWS's responsibility, covered by their published compliance programme; everything we build on top is ours.
We keep the public site deliberately simple, which removes whole categories of risk:
The site does not currently send the standard protective response headers — Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Content-Security-Policy, Permissions-Policy. These are configured at the CDN, not in the page code, and a reviewer reading this page will check for them.
Access to production systems is limited to personnel whose role requires it, and is granted on a least-privilege basis.
Access control is the single most scrutinised section of any vendor security review. Claiming MFA or quarterly access reviews without them in place is materially worse than saying nothing. Confirm each line, publish what is true, and delete the rest.
Our platform is built to minimise what it holds. In serving an ad decision we process request-level signals supplied by the publisher's player or delivery layer.
When a publisher uses our ad server, that publisher is the controller of its viewer data and GoGo CTV acts as its processor. What we may do with that data is set by the customer's agreement and its data processing addendum — not by this page and not by our website privacy policy.
A customer-facing data processing addendum needs to exist for the statement above to hold. It is also the document an enterprise publisher will ask for first, usually before signing.
Our decisioning infrastructure is deployed across multiple AWS availability zones with automated failover, and the content delivery layer is globally distributed.
Availability figures published elsewhere on this site are derived from our own internal measurement and are not independently audited. Any binding availability commitment exists only where it is written into a signed customer agreement.
We maintain an internal process for detecting, triaging, containing, and remediating security incidents, and for notifying affected customers.
If you are a customer and believe an incident affects you, contact us immediately using the details in section 12.
We welcome reports from security researchers, and we would much rather hear from you than not.
Email security@gogoctv.com with enough detail for us to reproduce the issue — the affected URL or endpoint, the steps involved, and the impact you believe it has. Please give us a reasonable period to investigate and fix before any public disclosure.
The security@gogoctv.com mailbox must exist and be monitored before this page goes live. Publishing a reporting address that bounces is worse than publishing none — researchers post publicly when they cannot reach a vendor. A /.well-known/security.txt file should also be served; one has been drafted alongside this page.
If you make a good-faith effort to comply with this policy during your research, we will not pursue or support legal action against you, and we will treat your research as authorised conduct. If a third party brings legal action against you for activity that complied with this policy, we will make that authorisation known.
gogoctv.com and its subdomainsWe do not currently operate a paid bug bounty programme. «CONFIRM: keep this line, or state a reward policy if one exists»
We use a small number of providers to deliver our services. Website-related processors are listed in our Privacy Policy.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Compute, storage, content delivery, email delivery | United States |
| Google Analytics | Website analytics for this marketing site. Advertising features disabled; analytics storage denied by default in the EEA, UK, Switzerland and California. Processor under the Google Ads Data Processing Terms. | United States / Global |
| «ADD ANY OTHERS» | «PURPOSE» | «REGION» |
Customers can request notice of material changes to our subprocessor list under their agreement. «CONFIRM: whether a subprocessor change-notification commitment exists»
The site currently asserts "SOC 2 · GDPR · CCPA" as completed fact on the ad server page. Until the attestation position is settled, this section deliberately makes no audit or certification claim, and the assertion elsewhere on the site should be removed or corrected to match.
Publishing an unattested SOC 2 claim is the most consequential misstatement available on a page like this: it is trivially verified by asking for the report, and failing to produce one ends the conversation. Whatever the true position is, state it plainly here.
We align our security practices to recognised industry frameworks and design our controls around the confidentiality, integrity, and availability of the data our customers entrust to us.
Our handling of personal data, including the rights available under the GDPR and the CCPA as amended, is described in our Privacy Policy.
Prospective customers evaluating GoGo CTV can request our current security documentation under a mutual non-disclosure agreement by contacting contact@gogoctv.com.
See also our Privacy Policy and Terms of Service.