Security

Security built into the money path

Your network moves real money through partner keys, click IDs and postbacks. Here is exactly how each one is protected, described from how the platform is built.

Start free trial Report a security issue

Fraud rules

Applied to every click

Block VPNs
ProxyCheck.io
Block proxies
ProxyCheck.io
Block Tor
ProxyCheck.io
Risk score at or above
0 to 100
75
Max conversions per user per day
More are held for review
5
Minimum seconds to convert
From click to conversion
30

Click blocked · VPN

Held for review

Survey Sprint · u_5521

6 conversions today, limit is 5

ApproveReject

Sample data

What we do

A separate database per network
Each network's offers, publishers, conversions and users live in that network's own database. Only platform-wide records such as accounts, plans, subscriptions and domains are kept centrally.
Encrypted partner keys
Partner credentials and ProxyCheck.io keys are encrypted with AES-256-GCM before storage, and decrypted only inside the jobs that need them. Edge records used by the click and postback servers hold no secrets.
Signed click IDs
Every click ID is an HMAC-SHA256 signed token binding network, app, user, offer and time. Signatures are compared in constant time; forged, altered or expired IDs never become conversions.
Authenticated postbacks in
Partner and manual postback URLs carry a secret key, stored only as a SHA-256 hash. Keys can be rotated at any time. Raw requests are archived before processing.
Verifiable postbacks out
Each publisher app has its own postback secret. Every postback carries a SHA-256 hash of the user ID, offer ID, transaction ID and that secret, so publishers can reject forged calls.
Learn more
Role-based permissions
Every console action maps to one permission, checked by the API. Six built-in roles range from owner to read-only support; only the owner can change billing.
An AI that cannot exceed your role
The assistant calls the same API with the signed-in user's session, is given only the tools their role allows, and shows a confirmation card before any change. Partner and offer text is treated as untrusted data.
Learn more
Audit log for assistant actions
Every change made through the AI assistant is recorded with the user, the action and its input.
Validated themes
Wall theme values are validated before they reach CSS or HTML: hex colours only, bounded radius, HTTPS-only logos and length-limited titles.
TLS on every domain
Network subdomains and custom domains are served over HTTPS, with certificates for custom domains issued automatically through Cloudflare for SaaS.

Built-in roles

What each role can do in the console and through the assistant.

Feature	Owner	Admin	Offers mgr	Publisher mgr	Analyst	Support
Offers and partners	Edit	Edit	Edit	No	View	No
Publishers and apps	Edit	Edit	No	Edit	View	View
Wall themes	Yes	Yes	No	Yes	No	No
Conversions	Reverse	Reverse	No	View	View	View
Fraud settings and review	Edit	Edit	No	No	View	View
Reports	Yes	Yes	Yes	Yes	Yes	No
Domains and settings	Yes	Yes	No	No	No	No
Team	Edit	Edit	No	No	No	No
Billing	Edit	View	No	No	No	No
AI assistant	Yes	Yes	Yes	Yes	Yes	Yes

Money

We never hold your funds

LaunchOfferwall tracks payouts and earnings but does not receive, hold or transmit money for your network. Partners pay you and you pay your publishers, so there is no platform balance to target. Subscription payments are handled by PayPal; we do not store card details.

01
Click
Signed click ID, screened at the edge
GET /c/off_1187?user=u_381
02
Partner
The user completes the offer
Everflow · offer 1187
03
Postback
Verified, stored raw, queued, 200
POST /pb/p/src_ev · txn_8f2c
04
Reward
Signed postback to the publisher
+1,200 Coins → u_381

Postback verified · +1,200 Coins

Sample data

Infrastructure and providers

The platform runs on Cloudflare Workers, with databases hosted by Turso, email delivered by Resend, subscription billing by PayPal and the AI assistant powered by Claude through Anthropic's API. ProxyCheck.io is used only when a network enables it with its own key. Deploy and runtime secrets are kept in managed secret stores, never in source code.

What we do not claim

We do not currently hold third-party security certifications or audit reports. If your procurement process needs a security questionnaire answered, email us and we will answer it accurately.

Reporting a vulnerability

Email hello@launchofferwall.com with the subject line "Security", a description of the issue and steps to reproduce it. Please do not access other networks' data or disrupt the service while testing. We will acknowledge your report and keep you updated while we fix it.

Questions about security?

Write to hello@launchofferwall.com and we will answer in detail.

Security built into the money path

What we do

A separate database per network

Encrypted partner keys

Signed click IDs

Authenticated postbacks in

Verifiable postbacks out

Role-based permissions

An AI that cannot exceed your role

Audit log for assistant actions

Validated themes