How we treat access to your org.
You are granting API access to a production marketing org. That deserves a page, not a sentence. Everything below is what re:target does today — not what it intends to do.
- Marketing Cloud write permissions
- 0
- Subscriber data read
- Never
- Metadata retention
- Until you delete it
- Hosting region
- US, or EU on request
The six read permissions we request
All six are read. re:target has no write permission in its installed package, so there is no code path by which it could modify an asset even if it tried. The connect page in the app shows this same table before you create the package.
| Permission | What it reads | Why we need it |
|---|---|---|
| Email and template metadata, and the folder tree | Inventories emails and templates and places them in your folders | |
| Documents and Images | Content Builder asset inventory | Counts and categorizes content assets |
| Saved Content | Content blocks used in slots | Resolves which blocks each email actually uses |
| Automations | Automation Studio definitions, steps and query SQL | Finds automations, their activities and what the queries read and write |
| Journeys | Journey Builder definitions, activities and event definitions | Inventories journeys and detects entry sources that need redesign |
| Data Extensions | Schemas, field metadata and row counts | Inventories data extensions — never a row of data |
What we store, and for how long
Metadata only
We store asset names, types, counts, folder paths, dependency edges and the definitions that describe them. We do not store subscriber records, email content bodies, send results or tracking data.
Recent scans, then deleted
We keep your most recent scans of each business unit so you can compare one run with the next, and prune the detailed data of older ones automatically. A metadata archive you build is deleted after 72 hours. An account admin can delete the whole account from its settings — every member, business unit, scan and export — and a member can delete their own login. Ask us and we delete everything about one business unit. Deleted data leaves our database backups within 7 days.
Credentials
Client ID and secret are encrypted at rest and used only to request short-lived access tokens from your tenant's auth endpoint. Revoke the installed package in Marketing Cloud and no new token can be issued; one already issued expires within 20 minutes. Ask, and we also delete the connection and everything re:target holds about that business unit.
Where it runs
Hosting runs in the United States — Google Cloud us-central1, chosen for proximity to the Marketing Cloud stacks we read from — or in the EU if you ask, at no extra cost. Application and database are in one region; nothing about an assessment is copied elsewhere. If your org cannot share infrastructure at all, private hosting puts re:target on infrastructure dedicated to you, in a region you pick. It is available on every offer, re:target assess included, as a paid engagement.
If you choose re:target transform
re:target never asks for write access to Marketing Cloud Engagement, on any offer. Moving to Marketing Cloud Next means building in your Salesforce org, so a re:target transform engagement may also ask you to connect that org through an External Client App that you create and control. The permissions it carries are written into the engagement's scope before anything is connected, and removing the app ends the access.
Sub-processors
The third parties that can touch assessment data. This list is part of the contract: we give notice before adding to it.
| Sub-processor | Purpose | Region |
|---|---|---|
| Google Cloud | Application hosting and database | US (us-central1), or EU on request |
| Twilio SendGrid | Transactional email — sign-in, password reset, plan activation and report-ready notices | US |
| Google Workspace | Support correspondence | Global |
Have a security review to run? Send it over.
We answer questionnaires. If your metadata cannot leave the EU, ask for EU hosting. If your org cannot send it through shared infrastructure at all, private hosting exists for exactly that conversation.
Found a vulnerability in re:target or this site? Email security@retarget.marketing. Please give us a reasonable time to fix it before you publish, and do not access or change data that is not yours while you test. The same contact is in security.txt.