Affiliate Tracking Platform: Rent a SaaS Tool, Run a Tracker, or Build Your Own

Affiliate tracking records which partner sent a customer and what that customer later did, so that the right partner is paid the right amount. There are three ways to get it. You can rent a software-as-a-service (SaaS) platform that a vendor runs. You can install a tracker on your own servers under a licence. Or you can write your own tracking and payout system. They differ in who holds the raw data and who can change the commission rules.

What does an affiliate tracking platform do from click to payout?

A partner, also called an affiliate or publisher, gets a tracking link. When a visitor clicks it, the platform records the click and gives it a click ID, a unique code for that one click. Everflow, one of the vendors, says tracking answers “which partner sent this customer?” and does so by “assigning a unique ID to every click”. The visitor lands on the advertiser's site with the click ID attached. When the visitor later signs up or buys, the advertiser's system reports the conversion, the action you pay for, together with that click ID. The platform matches the two, applies the commission rule and adds a payout, the amount owed to the partner, to that partner's balance. All pages quoted in this article were read on 10 November 2026.

Should you use browser pixels or server-to-server postbacks?

A browser pixel is a small piece of code on the thank-you page. It runs in the visitor's browser and reports the conversion. A postback is a message that one server sends to another when a conversion happens. This is called server-to-server, or S2S, tracking: the advertiser's server calls the tracking platform and passes back the click ID. Voluum's documentation calls it “a server-to-server (S2S) method of tracking conversion”. Everflow says the call comes “from your server, not the user's browser”.

Everflow's help centre says a pixel “can break with ad blockers or cookie clearing”, while a postback is “immune to ad blockers and cookie issues”. Those are Everflow's claims, and the logic holds for the postback itself: a call between two servers does not depend on the visitor's browser. The click before it still does. The price is work on your side. Your system must store the click ID on arrival and send it back later, also from your customer relationship management (CRM) system for sales closed offline.

How do Safari and Chrome cookie limits affect tracking today?

A cookie is a small file a site stores in the browser to recognise a visitor later. WebKit, the engine behind Safari, publishes its rules. Its Intelligent Tracking Prevention (ITP) “by default blocks all third-party cookies”. ITP also watches links that carry an ID in the web address, which is how click IDs usually travel. When it detects this, ITP “caps the expiry of cookies created in JavaScript on the landing webpage to 24 hours”. It also deletes script-written cookies and other storage “after 7 days of no user interaction with the website”.

Chrome went another way. On 22 April 2025 Google wrote that it would “maintain our current approach to offering users third-party cookie choice in Chrome”. On 17 October 2025 it said it would “retire the following Privacy Sandbox technologies”, among them the Attribution Reporting API, a browser tool for measuring ad conversions. Google's cookie page, last updated on 26 October 2026, says cookies “can be blocked by browser design, Enterprise policy, or user choice”. So a click ID kept only in a browser cookie will be lost for some visitors. Store it on your own server when the visitor lands.

Why do two affiliate tracking systems disagree about who gets credit?

Attribution is the rule that decides which partner gets credit when more than one touched the customer. Last click gives it to the partner whose click came last before the conversion. For cookie-based conversions, Everflow's default does this: it “attributes the conversion to the Partner who drove the last click before the conversion took place”. First click gives the credit to the earliest partner. The attribution window is how far back the system looks for a click, and an older click earns nothing. Everflow's fraud guide says “7-day click-through attribution is the standard, some advertisers have 30-day click-through attribution”.

Two systems disagree when they use a different rule or window, cut the day at a different time zone, treat repeats differently, or lose a click ID. Write the rule, the window and the time zone into the partner terms before the first payout.

What does a SaaS platform include, and what do you give up?

A SaaS platform usually gives you hosted tracking links, partner sign-up, reporting, payouts and fraud tools in one account. TUNE describes itself as “a fully customizable SaaS platform” with an “API-based foundation with over 650 endpoints”. impact.com calls itself “the partnership management platform connecting brands with affiliate publishers, creators, and advocates to drive measurable results and revenue”. Everflow and Affise sell to advertisers and networks, and Voluum is a hosted tracker.

You give up some money, control and history. Everflow's pricing page asks you to “Request Personalized Pricing” and says “We require a 6-month commitment for our Everflow plans”. TUNE's advertiser plan page lists Scale at “$1,500 per month paid annually” with “2,500 / month” in conversions included, and marks partner payments and onboarding as “Fee Based”. Affise's entry plan lists “7 000 conversions” and “Unlimited clicks”. Voluum lists “Up to 1,000,000 events” on one plan. Limits like these decide your bill as volume grows.

What does a hosted or self-hosted tracker take to run?

A tracker is software that records clicks and conversions. A hosted tracker is run by the vendor, like any SaaS. A self-hosted one runs on your own server under a licence, as Keitaro does. Its pricing page offers “individual plans for marketers & media buyers”, so it is aimed at people who buy traffic. Check what it offers for partner sign-up, approvals and payments.

Its documentation says a “server (VPS or VDS) is required to install and run Keitaro” and names CentOS Stream as the operating system. A pre-installed server still needs a licence. It sizes the server by daily clicks, and “Updating the tracker and server version” is a listed maintenance task. You own the server, the backups, the patches, the capacity and the uptime.

What fraud should you expect, and what does each route give you?

Click spamming is the first pattern. Everflow describes a fraudster who “fires their click tracking link every time a user sees their ad”. The partner then takes credit for sales that would have happened anyway. Cookie stuffing places a cookie on a visitor who never clicked; impact.com lists “evidence of cookie-stuffing” under suspicious traffic. Click injection fires a link just before a conversion completes, and for app installs Everflow calls click-to-conversion times under 15 seconds “almost always suspicious”.

A SaaS platform brings ready tools. Everflow's SmartSwitch rules “block traffic, fail traffic, or send alerts”, and by default Everflow rejects a second conversion from the same click ID. impact.com's reason codes flag proxies and recommend “a careful manual review of any events flagged with this reason code before you approve payouts”. TUNE lists “Proactive Fraud Prevention”. A self-hosted tracker gives you logs and rules you set up. A custom build gives you every signal and the job of writing the detection. On every route, hold payouts for a review period before they become final.

How do payouts, reconciliation and partner disputes work?

Payout rules say who is paid what, and when. impact.com documents one model. A conversion starts as pending, and pending actions “can be modified or reversed within the locking period”. After the locking date they “become locked actions”, and “The commission amount due on locked actions is final”. Your own programme needs the same two dates in writing: when a conversion can still be reversed, and when it is paid.

Reconciliation means comparing the platform's conversion list with the advertiser's own orders or CRM records, line by line, each period: count, value, status and refunds. Gaps usually come from refunds after the fact, duplicates, time zones and conversions that arrived without a click ID. Agree in the partner terms which side's records decide. A dispute is settled by a record: the click, its ID and the conversion. With only totals, you cannot show a partner why a conversion was rejected.

What do EU and US privacy rules mean for tracking and partner data?

In the EU, the European Data Protection Board's Guidelines 2/2023 on the ePrivacy Directive, version 2.0 of 7 October 2024, cover tracking links and give affiliate marketing as an example. They describe tracked links given to partners so that a shop knows whom to pay a commission, “a practice known as affiliate marketing”. They treat delivering such a link to a user's device as storage, so “Article 5(3) ePD is applicable, even if this storage is not permanent.” Whether your set-up needs consent or fits an exception is a question for your lawyer.

In the US, rules differ by state. The California Attorney General lists “The right to opt-out of the sale or sharing of their personal information including via the GPC”. GPC is the Global Privacy Control, a browser setting that tells a site to stop selling or sharing a person's data. Click logs hold IP addresses, and partner records hold names, bank details and tax forms. With a vendor, ask who decides why the data is used and who only handles it on the other's behalf. The EU calls them controller and processor. California calls them business and service provider. Also ask who signs the data processing terms.

How do you test a platform against your current system?

Run both at once. Everflow's pricing page FAQ describes a migration in which you keep running your existing programme “and the data will collect in both platforms”.

• Send the same live clicks and conversions to both systems for several whole weeks, storing each system's click ID.
• Decide the question and the pass line first: clicks, conversions and value per partner, and the delay between conversion and report.
• Include hard cases: Safari visitors, browsers built into other apps, refunds, and conversions that happen offline.
• Explain every gap before you move any payout, using numbers from your own database.

What do you keep if you leave an affiliate tracking vendor?

Everflow's schedule gives clicks “Raw-level 90 days High-level 2 years” and conversions “Raw-level 1 year High-level 2 years”. To retain a copy of conversion data, it says to use its API or “request an export through the UI”. Voluum's Profit plan shows “6 Months of Data Retention”; its other plans list 12 to 24 months. Everflow also says “We provide free data migrations from all networks and platforms”. That concerns moving in; the pricing page says nothing about moving out.

Ask in writing for a continuous export of raw clicks and conversions to storage you control, for the whole contract term. Use a tracking domain you own (the web address your partner links point to), so you can point partner links at a new system after a switch; TUNE's plan table lists a “Secure Custom Application and Tracking Domain”. Ask also for the commission rules in readable form, the payout history and a notice period.

When is building your own tracking and payout system justified?

Rarely, and usually after a platform has shown where it falls short. These can justify it:

• Your volume is so high that per-event fees cost more than a team that maintains your own system.
• Commission rules depend on data a platform cannot reach, such as net revenue after refunds, tiers across products, or rules per partner contract.
• Tracking and payouts are a product you sell to others, for example your own affiliate network with a partner portal under your own brand.
• Contracts or rules require every click and conversion record to stay inside your systems.

Do not build because two reports disagree. A new system adds one more set of numbers. A build needs a service that collects clicks even in traffic bursts, a store for click IDs and a postback address that accepts the message again if the first one failed. It also needs commission rules, fraud filters, a payout ledger (the record of what is owed and paid), a partner portal and reports, plus upkeep.

What should you ask a vendor or a firm that would build it?

• What exactly do you charge, what counts as an event, and what happens above the limit?
• Can we export raw clicks and conversions continuously, in what format, and for how long are they kept?
• How do you store and match click IDs, and how does tracking behave for Safari visitors?
• Which attribution rules and windows can we set per partner and per offer?
• How do you detect click spam and cookie stuffing, and can we see the signals behind a flag?
• How are payouts held, reversed and exported, and how do we reconcile against our own records?
• Who is the data processor, and which data processing terms do you sign?
• Will you run beside our current system on live traffic, and what do we keep on leaving?

Where does amBrain fit?

amBrain publishes this blog. In its own words: “amBrain builds event analytics pipelines for ad tech: collection, processing and reporting of impression and click events.” Click events are one input to affiliate tracking. That line does not cover conversions, commissions or payouts.

amBrain has been building software since 2019. On how it works with clients it says: “Three formats: full delivery, a dedicated team, or engineers embedded in your team.” Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” Ask for the list of those components by name before you sign.

This article is not a case study and describes no client work. The lines above name no client, and nothing here says that amBrain has built an affiliate tracking or payout system for any company. The article gives no amBrain prices or timelines and claims no relationship with any vendor it names. Every outside source is cited from its own page.

It is not legal advice either. Have a lawyer read vendor contracts, data processing terms and your consent set-up before you sign. If amBrain is on your shortlist, ask it the same questions as any other firm.