Skip to content
Verification & fraud

Fraud protection that can explain itself.

The synchronous gate on the hot path may only reject or hold, never approve. Approval is earned through adjudication. Every decision records the ruleset that made it and the signals that fired.
Synchronous gate, on the serve/postback path Asynchronous, off the hot path
1

Signature & replay

HMAC signature over canonical params + timestamp, with nonce replay protection. Stale or forged postbacks are rejected at the door.

Sync · reject or hold
2

Deduplication

A stable idempotency key collapses duplicates, including the same event arriving from both your S2S and an MMP, to a single conversion. Never a second payout.

Sync · reject or hold
3

Structural validation

App and campaign resolution, ad-id format, attribution window and max-age. Malformed or out-of-window events do not proceed.

Sync · reject or hold
4

Velocity limits

Precomputed rolling counters rate-limit per user, publisher, offer, device, and IP, catching abusive bursts within the serving latency budget.

Sync · reject or hold
5

Adjudication

Heuristic scoring, then a manual-review queue. Suspicious conversions hold in pending; only a human or rule approval can release them to paid.

Async · can approve

Versioned rulesets, shadow mode

A new ruleset runs log-only in shadow before it ever enforces, so you see its effect on real traffic with zero risk, then promote it.

Thresholds are data, not code

Limits and scores are configuration, tuned without a deploy. The deciding version and fired signals are logged per decision, explainable and disputable.

Separate machine auth

SDK app keys and S2S HMAC secrets are first-party and issued on distinct routes from human dashboard sign-in. Secrets are shown once and never read back.

Privacy-first by default

Opaque user references over durable device ids, consent-first handling, and support for data-subject deletion and retention windows.

Honest boundaries

Who is authoritative for what

Honest boundaries beat false certainty. We are explicit about which signals we own and which we treat as corroboration.

We adjudicate

Internal demand and our own S2S postbacks run the full five-layer pipeline end to end.

We corroborate

MMP fraud flags are ingested as additional signals, never treated as sole truth for approval.

Spend and earn on traffic you can trust.

Verification and fraud screening are on from your very first conversion.

Get started See how it works