Know exactly who can open your numbers, and exactly what they can change.
Your dashboard opens only for an address that holds a seat on your account. Remove the seat and it stops working within 30 seconds. The screen can write to four places, and this page lists all four.
Who can open my dashboard?
Only a person who passes two checks. The first is an access gate on your dashboard's hostname. It confirms who the person is before a single byte of the page is served. The second is our seat list. It confirms that this person holds a seat on your account. Pass the first without the second and you get a refusal page, not your numbers.
The proof of identity is verified, not trusted. Every request carries a signed token. The token is checked against the gate's published keys and pinned to your dashboard, so a login for one dashboard cannot be presented to another. Your dashboard tells search engines not to index it, and its preview hostnames redirect to the one gated host, so there is no side door.
Sign in with a link, not a password. Enter your address at login.trulata.com and a single-use link arrives at the address on your seat. It works once and expires in 15 minutes. Hold seats on more than one account and you pick which to open. There is nothing to set, share or reset, and nothing for us to store.
How fast can I remove someone?
Within 30 seconds. Say a bookkeeper leaves on a Friday. Open the Team view and press Remove beside their address. Within 30 seconds every request from that address gets a refusal page that names the address, says it does not hold a seat on this dashboard, and tells them to ask the account owner. That includes the data file the page draws its numbers from, not only the page itself, so a removed address cannot fetch your numbers directly.
The 30 seconds is a cache, and it is stated so nobody assumes instant. One page load is a dozen requests, and each one is checked against the seat list, so the decision is held briefly instead of asked a dozen times. A removed seat can keep working for up to 30 seconds on a request that was already decided. Not a day, not a policy change at a vendor. Thirty seconds.
Adding someone is the same view. Type their email, pick Member or Admin, press Invite. They receive a sign-in link and they are in. The view shows seats used against seats on your plan, and when the plan is full it says so instead of silently failing the invite. Seats by plan: three on Starter, three on Launch, ten on Growth and unlimited on Command.
What can someone with a seat actually change?
Four things, and this is the complete list. Ask a question in the assistant view, where it is offered. Set a lead's outcome. Request a website change. Request a content, keyword, category or targeting change. Everything else on the screen reads.
Here is what each one does. A lead outcome is a control on the Leads view: mark a row as not a lead, choose why (existing customer, spam, wrong number, out of area, other), add a note, and it is written to that lead's record. A request opens a box that goes to your TruLata team. Send it and the screen hands you a ticket number you can quote back to us, and the Support view lists the ticket. Every one of these is logged with who did it.
None of them writes to your ad account, your CRM, your website or your Business Profile directly. A person on your team or ours makes those changes. In your ad account, the change watch reads every change the next morning at 7:05am ET, and budget and bid changes there are made by a person, never by a scheduled job.
Check it in the demo. Open demo.trulata.com, go to Website and press Request a website change, or open Settings and press Edit beside Brand voice. A box opens that says Goes straight to your TruLata team. On the demo the send is simulated and the toast says so; on your instance the same button sends, logs and hands you a ticket number. Open Team to see seats used against plan seats and the invite box with the roles Member and Admin. That is the whole write surface, and you can find it in ten minutes.
Where does my data live, and what leaves with me?
Your numbers are served from a managed cloud service, not from a machine in an office. Your connection map, which of your accounts is which, is a per-client record with us. Lead rows live in the sheet your own website writes, in your Google account. Content is filed as Google Docs in a Drive folder that is yours. Nothing worth keeping waits for an export, because it was written to your accounts as it was made.
Every Google connection is a manager invitation on your Analytics property, your Search Console site, your Ads account and your Business Profile. You grant it in your console and you can revoke it in the same console. We do not hold your passwords. Our team connects your CRM, Stripe, your booking platform, your email platform and your forms from the inside with access you grant during setup; there is no wizard and nothing for you to paste.
Not connected on any client instance: your email inbox, your calendar, your customers' card data. A phone call counts as a lead only when your CRM records it. Stripe is read only; nothing here creates a charge or a refund.
If you leave, you revoke the manager invitations in your own consoles, your seat list is emptied, and the Drive folder and the lead sheet stay yours because they were always in your account.
Who is watching my accounts for changes I did not make?
A scheduled read, every morning. At 7:05am ET the ads change watch reads your Google Ads change history. It also reads the account's user list directly, because a change event does not record who was granted access. On one account we manage, a competing agency's address was granted read access; the change log could not show it, and the user list did.
Most changes are ours, and the watch says so. Across the accounts we manage, one 29-day window held 337 change events; 291 were our own writes and 21 were material. The watch exists for the 21. One of them: a Google auto-applied recommendation flipped an AI-driven setting on across three search campaigns in one second under a client staff login, ran 26 days, put impressions up roughly five times and cost up 65 percent week over week, and conversions stayed flat.
The rest of the schedule is boring on purpose. A nightly bake at 12:01am Central writes the fallback snapshot for every client, and a failed pull leaves the previous page up rather than shipping an empty one. Once an hour a job checks that your dashboard's seat pin, its registry row and its live access application still agree.
What stays with a person: budget and bid changes in ad accounts are made by a person, never by a scheduled job. Prospect emails leave from a review-first queue; a person releases them, or the queue releases on the schedule set for the engagement, and every send is logged.
What happens when a check cannot be made?
You stay in. If our seat service does not answer within two seconds, a person who has already passed the access gate is allowed through, and that decision is written to the log. The gate has confirmed who they are; our layer only ever narrows that set. A blip on our side must not lock you out of your own numbers, and a removed seat working a few minutes longer during an outage is the smaller failure.
Two refusals never relax. A login minted for a different dashboard is refused, because a wrong audience is not an outage, it is a token that was never for this door. A login with no email identity is refused, because a dashboard is a human surface and a machine identity holds no seat. Every fail-open is logged, so the gap is visible rather than silent.
Before every deploy, a preflight checks the door itself. The redirect from preview hostnames is present and points at your canonical host. It is a 302, never a 301 a browser would cache forever. The engine matches the canonical build. The data file is present and assets are pinned. No other client's name appears anywhere in your instance. No build junk ships. A failed check stops the deploy and the previous page stays up.
If the numbers behind the page are late, the page says so. The header stamp shows how old the data is, and Refresh starts a real pull instead of showing an error.
Access, in one table.
| What | Where it comes from | How fresh |
|---|---|---|
| Authentication | Access gate on your dashboard hostname | Every request |
| Authorisation | Seat list on our cloud service | Every request, decision held 30 seconds |
| Sign-in | Single-use link from login.trulata.com | Works once, expires in 15 minutes |
| Removal | Team view, or ask your team | Effective within 30 seconds |
| Google account access | Manager invitations you grant | Revocable by you in each console |
| Write log | Every write from the screen, with who did it | Live |
| Ads change watch | Change history and the account user list | Daily, 7:05am ET |
The four write paths above are everything the screen can change, and a fifth would change this page before it shipped.
Questions, answered.
How do I sign in?
With a single-use link sent to the address on your seat from login.trulata.com. It works once and expires in 15 minutes. Hold more than one seat and you choose which account to open.
How fast does removing someone take effect?
Within 30 seconds. The decision is held briefly so one page load does not ask the seat list a dozen times, and that hold is the whole delay.
Does the product change my ad account or CRM?
No. Nothing on the screen writes to Ads, your CRM, your site or your Business Profile directly. A person makes those changes, and the ads change watch reads your ad account every morning at 7:05am ET.
Do you store my passwords?
No. Google connections are manager invitations you grant and can revoke. Other accounts are connected with access you grant during setup and can withdraw.
What if your service goes down?
You stay in. Someone already past the access gate is allowed through and the decision is logged, and the page shows the last snapshot with its age. The two refusals that never relax are a wrong audience and a login with no email identity.
Can another client see my dashboard?
No. Each dashboard is its own site on its own hostname behind its own gate, and a preflight before every deploy fails if another client's name appears anywhere in your instance.
What do I keep if I leave?
Your Drive folder of content, your lead sheet, and your own accounts with our manager access revoked by you.
See it running
before you decide.
The demo is the real product on a fictional company, with no form in front of it. Pricing is three published tiers. Setup on your own accounts takes two to four weeks.
Open the live demo See pricing
New here? See what the Command Center is. Prefer to write? Send us the one thing you want to know.
- Refreshed when you open itLive data on page load, never a monthly PDF
- Counted from your own formsLeads recorded server-side, compared daily with Ads and GA4
- Four answer engines, measuredChatGPT, Gemini, Claude and Grok, with a published denominator
- A review-first queue on every sendEvery draft waits in a review-first queue and every send is logged.