Built around defensible attribution evidence.
HTTPS transport
Production traffic is served over HTTPS/TLS.
Server-authorized conversions
Sensitive conversion events are designed to use private server-side authorization instead of trusting the browser to assert commission-bearing conversions.
Site-scoped browser keys
Browser ingestion keys are site-scoped and are not treated as private secrets.
Idempotency
Server-side conversion ingestion supports idempotency protection to reduce accidental duplicates.
Operational isolation
Monitoring failures are designed not to break a merchant's payment flow.
Restricted administration
Operational dashboards are protected behind application authentication and should only be accessible to authorized operators.
Responsible findings
Risk findings are indicators for review and are not, by themselves, proof of intentional fraud.
Security contact
Report suspected security issues to support@attributionguard.eu. Do not send live secret keys in the first message.
No certification claim: AttributionGuard does not claim SOC 2, ISO 27001, PCI DSS or other independent certification unless explicitly published.