Log in as

Networks: use the sign-in link from our team.

How will you use AffiliateOS?

Product

Monetization

Features

Platform

Publishers
Top offer now: Monopoly Go, $9.49 per install

Use cases: non-incentivized

Use cases: rewarded traffic

Advertisers

Test events are free. Verify each required event before you go live.

Verticals

Networks
Help

Developers

Pause animations

Security

Signed postbacks, hashed keys, masked channels.

How AffiliateOS handles the data and keys you trust it with. Every line on this page was checked against our code on 29 October 2026.

Ask a security question

  1. 01 Postbacks

    No unsigned postbacks to publishers.

    Every Postback. A request we send to your server when a conversion happens, so you can credit the user.What is a postback? we send a publisher carries a verifier: an HMAC-SHA256 of the full URL, keyed with your postback secret. No active secret, no postback. Network postbacks are signed once the network sets a secret.

    How postbacks work

  2. 02 API keys

    No API key shown twice.

    You see a new key once, when you create it. We keep a SHA-256 hash and a short prefix so you can tell keys apart. Lost one? Revoke it and make another.

    Keys in the developer docs

  3. 03 Channels

    No publisher names in marketplace reports.

    Advertisers see Masked channel. A traffic source shown to an advertiser under a code instead of the publisher's name.What is a masked channel?, not publishers. Each code is a keyed hash that differs per advertiser. If the code can't be made, the row isn't written.

    How channel reports work

The boxes under each promise are examples of what you'd see.

The ledger

What we keep, what we send and why.

Seven things that would hurt if they leaked or were faked, and how each one is handled.

What How we handle it Why
A click click_id, offer, your Sub ID. Your own value attached to a click, usually your user's ID. We send it back to you in the postback.What is a sub ID? and subsource_id, IP address, user agent, device and OS, country from IP, time; on links with a fraud check, device signals our click page reads (screen size, time zone, language)
Kept as one record per click. How long we keep it is set by the Privacy Policy, section 4.
To match a conversion to the tap that caused it, and to check the traffic.
Your sub1 to sub10 sub1 ... sub10, up to 128 characters each
Kept for 90 days and returned on that conversion's postbacks and reversals. Never sent to the advertiser.
So your own system can match our conversion to its own click.
Postbacks to publishers &verifier=
Signed with HMAC-SHA256 over the full URL, keyed with your secret. Without an active secret, we don't send them.
So your server can reject any request we didn't sign.
API keys pk_ and ak_
A SHA-256 hash and a short prefix. The full key is shown once.
A copy of our database can't be used to call the API as you.
Publisher and advertiser passwords
A bcrypt hash. Never stored in plain text. Network sign-in goes through our sign-in provider, so we never hold those passwords.
Signing in only needs to check the password, never to read it.
Marketplace reports channel code: a keyed hash, 43 characters
Channel codes made with a keyed HMAC, different for each advertiser. No publisher names.
An advertiser can judge a channel without learning whose it is.
A network's own source logins
Encrypted with AES-256-GCM. Only the network's owner can add or change them.
So we can sync the network's own offers while the stored copy is never in plain text.

We publish no compliance badges; this page is the claim, and it's dated.

Details

The questions buyers ask next.

  • Four roles on publisher teams

    Owner, Admin, Manager and Analyst. Analysts can read but not change anything. Managers can also edit postbacks and properties, and request offer access. Admins also manage the team and API keys, and always see earnings and billing.

  • Earnings only for seats that may see them

    A seat without earnings access gets reports with the money left out by our server, not hidden in the browser. Admins always have it; you can give it to anyone else.

  • Up to five API keys per publisher account

    Make a new key, move your servers to it, then revoke the old one. A sixth key needs one revoked first.

  • Check a postback yourself

    Remove &verifier= and its value from the URL. Compute a hex HMAC-SHA256 of what's left with your postback secret, then compare the two.

    verifier = hex(HMAC-SHA256(url without &verifier=, secret)) Postbacks in the developer docs

  • A rate limit on advertiser events

    The advertiser events endpoint takes up to 120 calls a minute for each advertiser account, whatever server sends them.

  • We don't sell personal information

    Our Privacy Policy says who we share data with and why, and how to ask for a copy or a deletion.

    Read the Privacy Policy

Found a security problem?

Email hello@affiliateos.ai with Security in the subject and the steps to reproduce it. We reply by email.

Contact us