What to look for when choosing a Google Ads and Meta Ads tool

Feature lists look alike across tools. The difference shows when something goes wrong: measurement double-counts conversions, a campaign is in its learning phase, and someone in a chat says "raise the budget on what works".

This guide is a set of criteria, not a feature list, for telling a tool that helps from one that speeds up your mistakes. We illustrate each criterion with how Phanes works.

Data security: how account access is protected

An ad account access token is the key to the budget. A good tool encrypts it, keeps it out of logs and separates client data in every query. Here is how Phanes does it:

1. AES-256-GCM encryption

   Google and Meta tokens and cached API responses are encrypted with a random 96-bit IV and an authentication tag. Without the key, production refuses to store a token.

2. Masking in logs

   Meta and Google tokens, API keys and Bearer headers are stripped from every error message before it reaches the database.

3. Account isolation

   Direct table access is blocked by database policies, and the application checks the account owner and the confirmed account selection on every query.

4. Least privilege

   GA4 and Search Console are read-only. The Meta connection is protected by a one-time key in an httpOnly cookie.

5. Learning without exposing your data

   Knowledge from many accounts is used only as an aggregate of at least 3 accounts, none with more than a 40% share. No names, no identifiers.

Many tools mention encryption only in general terms. Ask for specifics: what is encrypted, with which algorithm, and where the key is kept. In Phanes: access tokens and cached API responses, AES-256-GCM, and a key stored outside the database.

Conversion measurement: the criterion few people ask about

Most tools assume the account's conversions are real. But a GTM tag can count a conversion on every page view, two tags can count the same transaction, and a purchase can reach GA4 without a value. Optimizing on such data moves budget to where numbers are inflated, not to where the sales are.

Phanes starts with a measurement verdict, which has four states. Missing data never counts as "all OK"; the engine treats it as unverified. When measurement is suspect, conversion-based cards are not published and you see what needs fixing. If you know measurement is fine, you can mark it as correct yourself.

Decision security: where a recommendation comes from

A language model can answer differently on the same data, even at temperature 0, as model vendors themselves admit. In a draft text that is a detail; with an ad budget it is not. That is why the rules engine makes the decisions in Phanes, and every change follows the same path:

1. 1

   Measurement verdict

   First, a check on whether conversions can be trusted.

2. 2

   A rule from knowledge

   The recommendation follows from a specific rule and the account's numbers, and the card cites the rule.

3. 3

   Dry run in the API

   Every Phanes query is checked against a catalog of 3,050 Google Ads API fields, and the change passes a write validator and a write test without writing (validateOnly). The button appears only once there is a validation proof.

4. 4

   Diff preview

   You see exactly what changes: before and after.

5. 5

   Your approval

   Nothing reaches the account without a human click. At approval the account state is checked again.

6. 6

   Verification and undo

   After execution Phanes checks that the change went through, and you can undo it for 30 days.

This approach has a cost: Phanes sometimes declines to recommend because the data is incomplete or a campaign is in its learning phase. The reason for the refusal is visible on the card, and that beats confident advice built on bad numbers. When a recommendation does appear, it comes with a button: Phanes executes about 115 change types in Google Ads and 34 in Meta Ads through the API.

Four layers of validation before you see the button

The Google Ads API has thousands of fields and hundreds of operations, and some do not behave the way the documentation says. A tool that sends changes "to see what happens" is experimenting on your account. Phanes checks every change with four layers before anything reaches the account:

1. A catalog of 3,050 read fields

   Every Phanes query to the Google Ads API is checked against a catalog of 3,050 fields (v24 resources, attributes, metrics and segments). A field outside the catalog is flagged before the query reaches production.

2. Write validator

   Each of close to 150 change types (about 115 in Google Ads and 34 in Meta Ads) passes a validator that checks the operation's structure against the API contract before it is sent.

3. A write test without writing

   At preview, Phanes sends the change to the API in validateOnly mode: Google answers whether it would accept the change, but writes nothing.

4. Validation proof

   The button in a recommendation appears only when a stored validation proof exists for that change type. No proof, no button.

So the change you approve has already been checked by the platform's API. A rejected operation in the middle of a large change will not stop the whole campaign, because the problem shows up at preview, not in the account.

AI chat with skills, rules tool or expert engine

Typical traits of three tool categories. Specific products can differ, so ask the vendor about every point.

An AI chat with skills is a good assistant for analysis and writing. Rules tools are predictable but need an expert to design the rules. Phanes combines expert knowledge written into rules with a measurement check and a safe change path.

How to test a tool in 7 days

The best test is your own account. Here is how to use the 7 days of Phanes PRO to check every criterion in this guide.

1. 1

   Day 1: connect and audit

   Connect Google Ads and Meta Ads, run the audit and look at the measurement verdict. It is your first answer on whether the numbers can be trusted.

2. 2

   Days 2-3: recommendations

   Compare the cards with what you know about the account. Check that each one cites a rule, numbers and a loss amount.

3. 3

   Days 4-5: one small change

   Approve one small change and look at the before and after diff, the verification after execution and the undo option.

4. 4

   Days 6-7: monitoring and reporting

   Enable care, check the alerts and share analytics by link with whoever you report results to.

Five red flags

• The tool asks for your ad account password instead of OAuth sign-in.
• Budget changes can reach the account without your click, and that is the default.
• A recommendation does not say which rule and which numbers it comes from.
• Nobody checks whether conversions are counted correctly before a change is proposed.
• An executed change cannot be undone and has no visible history.

Seven questions for the vendor before you connect an account

1. How do you encrypt access tokens, and do they appear in logs?
2. How do you separate my accounts' data from other clients' data?
3. Does my data reach an AI model, and does the model learn from it?
4. What does the tool do when conversion measurement is broken?
5. Will the same data give me the same recommendation?
6. Who approves a budget change, and can I see the diff before clicking?
7. Can an executed change be undone, and where is its history?