Features
Engineered for confidence — ad-blocker resilient, cookie-deprecation ready, audit-prepared, and aligned with 14 regulatory regimes.
Quick answer
What does TopAdsROI's '15 lines of defence' mean?
Fifteen sequential safeguards from signal capture to forensic audit. Stages 1-3 capture first-party identifiers and bridge anonymous-to-known sessions. Stages 4-6 deduplicate events, route across pixels, and enforce data sovereignty. Stages 7-9 hash PII at rest, modularize replay, and verify scheduler routes via OIDC. Stages 10-12 augment match rates with CRM data, automate audience replays, and tune retention. Stages 13-15 ship per-event observability, multi-jurisdiction consent governance, and a forensic-ready audit trail.
15 sequential safeguards 5 defence stages
Fifteen lines of defence
From sGTM ad-signal capture through Meta CAPI / TikTok Events API / LINE CAPI ad-conversion dispatch to ad-data retention — every stage hardened, observable, and yours to govern.
First-party signal capture
Capture fbp / fbc / ttclid / line_uuid / gclid on your own subdomain — first-party signals survive Safari ITP's 7-day cookie cap and most ad-blockers, so fewer ad clicks go untracked.
Identity bridge
Bridge anonymous_id ↔ member_id with a 30-day rolling lookup — identity persists through login, so returning buyers stay attributed instead of being counted as brand-new.
Repair on the fly
Missing fbp / fbc on a conversion? We backfill from up to 30 days of history before the event leaves your edge — recovering conversions that would otherwise report as unattributed.
Event-ID dedup
One event_id per event — browser pixel + server CAPI are designed not to double-count, so FB Events Manager shows ‘Deduplicated’ and your ad ROI/ROAS reflects real sales, not inflated duplicates.
Pixel routing
Full-fanout, ratio split, event-based and time-based switching — route one event stream to 5+ ad platforms with zero re-tagging.
Data sovereignty
A managed document store + data warehouse inside your own cloud — Firestore + BigQuery on Google Cloud, DynamoDB + Redshift on AWS, or Cosmos DB + Synapse on Azure. All of your ad data stays in your cloud, your region — by architecture. Direct SQL access, no vendor lock-in.
PII at rest = SHA-256
Email and phone are SHA-256 hashed before they ever touch your data warehouse — plaintext PII is not stored — it is hashed by design — across all 14 market regimes.
Modular by design
Pause the worker, fetch from the DB by hand, fire CAPI manually — every one of the 15 stages is replaceable. No black box, no lock-in.
Verified routes
Scheduled ingress routes pass OIDC + audience verification on every invocation — helping prevent spoofed or accidental conversion replays from hitting your ad accounts.
CRM-augmented match rates
Upload member_id / email / phone — we hash and attach them automatically. Richer identifiers raise CAPI match quality, so more conversions can be attributed and your effective CPA can improve.
Audience automation
Condition-scan triggers automatic CAPI replays for missed conversions — audiences stay complete without a single manual export.
Retention you control
730-day default retention with auto-purge across your warehouse + document store — tune it to the day per regulatory regime.
Observability built-in
Per-event success / permanent-failure metrics, Worker-bypass mode and a structured error_kind taxonomy — every dispatch to 5+ ad platforms is auditable.
Consent across 14 regimes
Cookie banner with server-verified consent re-prompts every 30 days; lawful basis routed across all 14 markets — APPI / PIPL / PDPA / GDPR Art.6(1)(f) per jurisdiction.
Forensic audit trail
Every login, mutation and event tagged with actor / IP / UA / Cloudflare ray_id — 365-day forensic retention, super-admin-only IP intel dashboard.
