Supply must be verified
Publisher applications record property and seller claims as unverified until evidence and commercial review exist. Submission does not make inventory live.
Trust centre
Trust begins by saying what is not live.
The current service records structured briefs, applies deterministic policy, proposes eligible routes and queues human work. It does not yet buy media, operate inventory, measure conversions or claim independent verification.
Current commitments
Controls that exist in the product today.
Context before identity
The planning MVP does not create a cross-site behavioural graph, fingerprint users, infer sensitive traits or accept uploaded customer lists.
People approve material work
A plan cannot trigger spend. Activation remains a separate request and an authenticated human decision cannot execute a media connector.
Tamper-evident business history
Business events use a chained HMAC-SHA-256 record and fail closed when integrity verification fails. This is not an immutable blockchain or an accredited audit.
Contact data is separated
Operational contact details are encrypted with an independent key, retained for a bounded follow-up period and exposed only through an authenticated, audited queue.
Control boundary
Implemented controls and gates still required before live media.
A roadmap control is not described as a production control. Connector execution stays disabled until every relevant gate has evidence.
Implemented now
- Bounded JSON schemas and request sizes
- Durable idempotency for business submissions
- Deterministic budget, category and route rules
- HMAC-chained ledger with tamper failure
- Encrypted, retention-bounded contact handoff
- Authenticated admin access with no shared customer credential
- Connector catalog reports execution disabled
Required before execution
- Contracted advertiser and publisher accounts
- KYB, inventory rights and creative review evidence
- Scoped connector credentials and sandbox tests
- Replay-resistant delivery and conversion events
- Independent invalid-traffic and measurement process
- Reconciliation, dispute and settlement controls
- Named users, MFA, RBAC, segregation of duties and kill switches
Measurement language
A number must carry its evidence level.
- Declared
- Provided by an applicant and not independently checked.
- Planned
- A deterministic allocation or requirement—not booked media or predicted performance.
- Platform-measured
- A future source-platform observation, identified by source and definition; not independent accreditation.
- Verified
- Reserved for evidence supported by a named independent process.
No “fraud-free” claim
Quality controls can reduce risk; they cannot erase it.
No traffic-quality, viewability, conversion or revenue result is claimed while inventory and execution connectors remain disabled.
Privacy by design
Use only the data needed for the declared job.
The public workflows collect business contact and planning or property inputs. The privacy notice explains the fields, encrypted handoff, default retention and HTTPS rights route.
Current defaults
- No automated media activation
- No persistent cross-site identity graph
- No precise-location or sensitive-trait inference
- Contact vault separated from analytical events
- Human approval and explicit connector status
Before market expansion
- Jurisdiction-specific role and purpose mapping
- Consent tooling where applicable
- Vendor and subprocessor register
- Children and political-ad controls
- Named-user security and rights operations
Read the operating rules
Check the policy before requesting scale.
The public advertising policy states what is excluded at launch and what evidence an applicant must provide.
Read the ad policy