Transparency

Every node declared. Every partner registered. Every claim verifiable.

We wrote the exchange ourselves — the wire contract, the auction, the logging layer. So transparency here is not a promise about a black box: it is the same set of artifacts we operate on, published for anyone integrating with us.

Public files

Three files. Canonical location. No redirects.

The obligation runs both ways. We validate the ads.txt, app-ads.txt and sellers.json declarations of the publishers and intermediaries we accept traffic from, and we match them against the domains and app bundles that actually reach our endpoints. A declaration that does not resolve is a supply path we do not open.

Standards we comply with

Protocol, supply chain, privacy. Each one checkable against our traffic.

  • OpenRTB 2.5Wire contract in both directions — inbound from supply partners, outbound to every DSP.Protocol
  • SupplyChain Object 1.0source.ext.schain populated on every bid request we surface, with hp=1 on the Adbustr node.Supply chain
  • sellers.jsonPublished at the canonical location, no redirects, seller_type and is_confidential declared per entity.Supply chain
  • app-ads.txt / ads.txtPublished at the canonical locations. Automated validation of counterparty declarations is not implemented.Supply chain
  • IAB Tech Lab content taxonomysite.cat and site.sectioncat enforced inbound; IAB25, IAB25-3 and IAB26 blocked on mainstream endpoints.Protocol
  • imp.secureSecure flag propagated end to end — HTTPS inventory receives HTTPS creative.Protocol
  • GDPRDPA available on request. Serving and data infrastructure run inside an isolated private-network perimeter.Privacy
  • CCPAOpt-out signals propagated to every downstream demand partner.Privacy
  • TCF v2.2IAB Europe consent framework — consent string parsed inbound and forwarded outbound.Privacy

How we treat traffic quality

Contract checks at the door, a reason code on every rejection.

Filtering happens before the auction, not after the invoice. Every request that reaches a downstream DSP has passed our inbound contract checks — and every request that did not is still logged, with the reason it was stopped. What those checks do not cover is listed in the policy below.

Inbound request filters

Every inbound OpenRTB request is checked before it costs anyone compute: device.ip and device.ua are mandatory, the user agent must resolve to our browser allow-list, and adult and illegal content categories (IAB25, IAB25-3, IAB26) are rejected on mainstream endpoints. Advertiser-domain blocklists (badv) are applied at the publisher level.

Enrichment and routing — Resonance

Requests that clear the inbound filters are enriched (GeoIP, browser and device classification) and routed to eligible demand. We do not operate proprietary or third-party invalid-traffic scoring in the bid path — our Anti-Fraud Policy states exactly which controls are and are not in place.

Independent verification support

Our impression and click pixels, win notices and per-request logs are structured for reconciliation by independent third-party verification partners engaged by our counterparties. Because we run no IVT scoring of our own, that measurement is the authoritative signal, and findings raised against our supply trigger a root-cause review.

Per-request audit trail

Every request gets a verdict. Every no-bid gets a reason.

Each inbound OpenRTB request is written to a per-request funnel table in ClickHouse: request id, endpoint, publisher, format, geo, domain, selected demand feed, verdict (bid or no-bid), the reason code behind it, the winning price and the revenue share applied. Impression and click pixels, plus nurl, burl and lurl notices, land in the same store. When a partner asks why their traffic did not monetise, the answer is a query, not an opinion.

  • unknown_endpointEndpoint uid is unknown or disabled.
  • no_ip_uadevice.ip or device.ua missing from the request.
  • browser_not_allowedUser agent does not resolve to an allowed browser.
  • non_mainstreamIAB25 / IAB25-3 / IAB26 category on a mainstream endpoint.
  • fanout_offDemand fan-out is toggled off — request accepted and logged, no DSP spend.
  • no_impEmpty imp array.
  • no_feedsNo live demand feed configured for the endpoint.
  • HTTP 400Body does not parse as JSON.
  • HTTP 204No-bid returned for any of the reasons above.

Reporting

Log level for the partners who need it. Dashboards for everyone else.

Reporting API

Authenticated per-partner API over the same aggregates our own dashboards read — impressions, spend, revenue share and fill, broken down by publisher, zone, DSP, format, country and day.

Self-serve dashboards

Publisher and advertiser cabinets expose the numbers behind the invoice, sourced from the aggregation layer rather than a separately maintained marketing view.

Statement reconciliation

Our counts are reconciled against DSP-side statistics, and Adbustr publishes the delta rather than absorbing it silently. Discrepancies are worked as engineering tickets against the raw logs.

Audit access

Active DSP partners may request log-level data access for reconciliation purposes under our standard audit protocol. Brand advertisers may request inventory breakdowns specific to their campaigns. Serving and data infrastructure run on dedicated servers inside an isolated private network; operator access goes through our own VPN, and a Data Processing Agreement covering GDPR and CCPA obligations is available on request.

compliance@adbustr.com