Server-side affiliate tracking on infrastructure you own

Client-side affiliate tracking loses the click ID after seven days under Safari ITP, and on a program whose median gap between click and order runs past that window, roughly a fifth of partner-earned revenue stops being attributable to the partner who earned it. This engagement moves tracking onto your own servers: a first-party subdomain on your DNS, server-to-server conversions fired from your checkout, and the affiliate platform running on a machine you hold the root password to. What gets built: We install and configure one of Post Affiliate Pro, Tapfiliate or Everflow on your infrastructure, and the choice follows your commission logic rather than our familiarity. Post Affiliate Pro where per-campaign commission rules go deep and your team can live with PHP and MySQL. Everflow where partner volume, offer caps and the API surface have to carry weight. Tapfiliate where the program is small and the integration budget belongs in the checkout instead. Behind whichever one you take: a click endpoint on track.yourdomain.com pointed by CNAME at your box, TLS terminating at nginx, the click ID written as a first-party cookie and carried as a URL parameter that survives to checkout, and the conversion posted from your order-confirmation handler instead of a pixel in a browser. Idempotency and refunds: Every conversion carries your order ID as transaction_id, so a retried webhook does not become a second commission. Refunds, chargebacks and cancellations fire a reversal from your Stripe, Shopify, Vindi or Pagar.me handler. Most programs we take over are paying commission on revenue that came back three weeks later and never told the affiliate platform. Wiring that reversal path is usually worth more than everything else in the engagement. Deduplication against paid media: Your ads platform and your affiliate platform will both claim the same order until somebody decides who wins. We write the rule as code in your conversion handler — channel priority, coupon-code override, direct-linking check — and document it in one page your finance lead can read. Without it, blended CAC is wrong in your favour, which is the expensive direction. Brazil specifics: Order and click data stays in-country where LGPD makes that easier to defend, with retention windows set explicitly rather than left at a platform default of forever. PIX-settled orders arrive in a different webhook shape than card orders and get their own conversion path, which is where most Brazilian installs quietly under-report. What this is not: We do not install a tag manager container and call it server-side. We do not migrate historical partner balances without a reconciliation the partners sign off on. We do not touch checkout code without a staging environment and a rollback. And if your commission model is a flat percentage on one product with no refund exposure, a hosted network tag is the correct answer and we will say so before you pay us. Who should not buy this: Programs under roughly forty active partners, and anyone who wants tracking built and then never maintained. Self-hosted means your team runs it. We leave runbooks and an on-call note; we do not become your operations desk. Verification before handover: Every install is signed off against a test matrix executed on real devices: Safari on iOS with ITP active, Chrome with third-party cookies off, an in-app browser opened from Instagram, and a refund round trip end to end. You get the recorded results, including whatever failed and what we did about it.