One event in. Every platform out. Consent spoken in each one's language.

The destinations

Ten types, one shape

Your events arrive once, in one common shape. Built-in per-platform mappings do the rest.

• GA4 via Measurement Protocol, with Consent Mode v2 signals, full ecommerce mapping and Debug View support.
• Meta Conversions API (v24.0) with SHA-256 hashing of match parameters, automatic event IDs for pixel deduplication, and hard event withholding when marketing consent is denied. Meta offers no consent flag, so we don't send and pretend.
• TikTok Events API with strict hashing and limited_data_use translation.
• Google Ads conversions through the Data Manager API: no developer token hoops, honest partial-success reporting, gclid/wbraid/gbraid attribution.
• Google Ads Customer Match audiences, gated on explicit ad-user-data consent, batched ten thousand members at a time.
• Snapchat CAPI and Pinterest API v5 (with OAuth token refresh that takes care of itself).
• Segment and RudderStack for CDP fan-out.
• Signed webhooks to anything else: four auth schemes including HMAC signatures, plus server-side request-forgery protection.

Adding a platform is a destination, not a project. No new tags, no new container, no re-instrumenting.

Consent translation

The part everyone else makes you wire by hand

One consent state from your CMP becomes, automatically:

• gcd and ad_user_data / ad_personalization for Google surfaces
• event withholding plus Limited Data Use flags for Meta
• limited_data_use for TikTok, data_use for Snapchat, opt_out_type for Pinterest
• Microsoft's asc signal

In sGTM setups this is a per-tag checkbox exercise where one forgotten box means non-consented data on a US server. Here it is not configurable enough to get wrong.

Reliability

Flaky platforms are our problem, not yours

• Deduplication, three layers. In-memory, then Valkey with a 24-hour window, then a Postgres audit trail. The same conversion never counts twice, even during retries.
• Retries with backoff on server errors; client errors surface immediately with the platform's actual response.
• Circuit breakers per destination. When Meta has a bad afternoon, your GA4 delivery doesn't feel it.
• Dead-letter queue with replay. Failed events are kept, inspectable, and re-deliverable once the platform recovers.
• Delivery logs that tell the truth, including partial successes, with per-destination status codes in the live debugger.

Strip by default. Hash on purpose. Send only what's allowed.

Each destination gets its own privacy settings, per field: strip, hash, or pass, for email, phone, names, IP, user agent and more. Defaults are strip. A capability registry knows what each platform legally and technically accepts, and coerces illegal combinations to the safe option. Fields a platform can't take are never sent at all.