Security and Role-Based Access
Every account is isolated, every request is checked against the signed-in user's role on that account, and subscriber identity is handled as a hash.
Accounts and team roles
A login can belong to several accounts — publisher, advertiser, agency — and switches between them from the account menu. Within an account, each team member has one permission level:
| Permission | Can |
|---|---|
| OWNER | Everything, including team management and deleting the account. |
| ADMIN | Everything except deleting the account; can invite and remove members. |
| MANAGER | Create and edit ad units, campaigns and creatives; view reports. No wallet or billing. |
| ANALYST | View reports and settings; no changes, no wallet or billing. |
| FINANCE | Wallet balance and transactions, top-ups and statements (with OWNER and ADMIN, the only members who can see them). |
| SPONSOR | Publisher accounts only: a direct-sold sponsor who sees impressions, clicks and CTR for the campaigns shared with them, and nothing else. |
Invite people from Team → Invite team member. Invitations expire after 7 days.
Isolation
Every data request is scoped on the server to the account in your active session — the browser cannot widen it. An agency sees only advertisers attached to it; a sponsor sees only the campaigns granted to them, re-checked on every request.
API keys
Create keys under Settings → API Keys. A key acts as the user who created it, with exactly the same permissions — there are no separate scopes. The key (prefix mlx_live_) is shown once at creation; only a hash is stored. Keys can be given an expiry and revoked at any time; a revoked key is refused on its next use. Send it as Authorization: Bearer mlx_live_….
Subscriber data
Subscribers are identified by the SHA-256 hash of their lower-cased email address. If a publisher's email platform cannot produce a hash and sends the plain address instead, the ad server converts it to the same hash on arrival and does not store the address — but it is present in the ad URL in transit. Subscribers can opt out of ads permanently via Ad Choices.
Activity log
Configuration changes are recorded with user and timestamp. Account members see their account's history under Governance → Activity Log; entries are kept for one year.