How it works
Affiliate tracking
Five events, four of which happen at the broker. The one that matters most is the fourth, and it is the difference between reporting conversions and computing a revenue share yourself.
- affiliate tracking forex
- cookieless affiliate tracking
- S2S postback
The five events
Step 1 of 5. Click
An edge worker on our own domain stamps a click identifier, writes a first-party cookie and a server-side row in the same request, and carries your five sub-IDs with it. Nothing downstream depends on the cookie.
Step 2 of 5. Registration
A server to server postback from the broker, matched on the click identifier. From this point the trader is locked to you permanently.
Step 3 of 5. Verification and first deposit
A postback carrying the amount, the method and the country. This is what starts the qualification clock on a CPA arrangement.
Step 4 of 5. Every closed trade
Symbol, volume, duration and spread, captured per trade and per broker, through the platform bridge. This is the event an affiliate platform does not have.
Step 5 of 5. Payout
The week locks, the payout file is produced, and the ledger entry is immutable from then on.
The four things that make it hold up
Server side first
The identifier is written to our own database in the same request that redirects you, and travels forward in the URL. Browsers block third-party cookies and shorten script-set ones, and forex traffic clicks on one device and funds on another. None of that touches an identifier that never depended on the browser.
Idempotency on every postback
Brokers retry and networks duplicate. Every request carries an idempotency key, and a replay is a no-op that returns the original result rather than a second accrual nobody notices until reconciliation.
Deterministic cross-device matching
Hashed email and phone captured at registration, matched against the click record. Not probabilistic fingerprinting, which is imprecise and difficult to justify under European data protection law.
Per-broker ledgers
Every trade row carries which broker it closed on, from the first day. A variance you cannot attribute to one broker's general ledger is a variance you will never resolve.
Filters flag, they never silently void
Qualified-lot rules exist and they are reasonable: a position held below a minimum duration, or opened while the spread was abnormal, is not the same as ordinary trading. What is not reasonable is removing those trades from a partner's statement without saying so.
Here a filter flags the trade with the rule that fired, and you see both. Every accrual also carries the rule version it was computed under, so a change to your terms never rewrites what has already been paid. Read the technical guide.
What is stored, and for how long
- Click log retention
- 24 months
- Audit log retention
- 7 years
The click identifier is pseudonymous until registration: it identifies a click, not a person. Addresses are stored hashed, and the raw form is kept only for as long as fraud and abuse investigation needs it before being truncated in place.
Server-side attribution that exists to perform the partner contract is a different processing activity from the marketing pixels on a site, and it does not sit behind the same consent gate. The marketing pixels do.
Questions
How long does attribution last?
Once a trader is matched to a partner at registration, the attribution is permanent and the revenue share continues for as long as that trader keeps trading. The window from the click to the registration is a separate figure that we have not published yet.
How many sub-IDs can I pass?
Five, and they travel with the click and come back on every postback, including on individual trades. That is what makes it possible to see which campaign produced traders who actually trade rather than only which campaign produced signups.
Can I get the events in my own tracker?
Yes. Outbound postbacks carry your macros to RedTrack, Voluum, Binom, the GA4 Measurement Protocol, Meta CAPI or a generic webhook.
Where this comes from
Sources
Primary sources only: the regulator, the standards body, the platform vendor, the legislation, or our own agreements. Not another affiliate's summary of one.
- StandardInternet Engineering Task Force
RFC 6265: HTTP State Management Mechanism
What a cookie is at the protocol level, which is what makes the difference between a first-party and a third-party cookie concrete rather than a marketing distinction.
- Platform vendorWebKit, Apple
Full third-party cookie blocking and more
The browser-side reason cookie-based affiliate attribution loses conversions, stated by the engine that does the blocking rather than by an affiliate network.
- LegislationOfficial Journal of the European Union
Regulation (EU) 2016/679, the General Data Protection Regulation
The lawful basis for server-side attribution, which is performance of the partner contract rather than consent, and the data minimisation rule behind the click log retention.
- LegislationOfficial Journal of the European Union
Directive 2002/58/EC on privacy and electronic communications, article 5(3)
Why storing an identifier on a reader's device is a separate question from processing it, and why a first-party click identifier is treated differently from a marketing pixel.