Attribution you can bank

1. The problem

Every ad platform reports its own conversions, and every platform is structurally motivated to claim as many as it can. Two of them routinely take credit for the same sale. Modeled and enhanced conversions fill reporting gaps with estimates. None of it is connected to what actually landed in your bank account.

A $40 lead that became a $12,000 job and a $40 lead that ghosted look identical in a platform dashboard. The result is familiar: claimed performance keeps looking better than the business feels, and budgets get allocated on numbers the seller of the ads produced.

Third-party attribution tools promised to fix this and mostly moved the problem. Another pixel on your site, another vendor holding your customer data, another model producing numbers nobody can trace. Trailhead is built on a different premise.

2. The premise

Trailhead measures from your side of the fence. Three design tenets run through everything.

1. First-party capture. The click never leaves your property until you decide to send it. No third-party pixel, no cross-site cookie. Capture runs on your own subdomain and sets no cookies at all.
2. Deterministic joins. A sale matches a click by hard evidence: a click id, a phone number, an email, in a strict confidence order. If no evidence exists, the revenue stays visibly unmatched. Trailhead never attributes by hope.
3. Exact money math. Every monetary figure is an integer in micros end to end. When revenue splits across touchpoints, largest-remainder allocation guarantees the per-channel numbers sum to the total, to the cent, every time. No floating-point drift and no rounding leaks.

Every number on a Trailhead dashboard traces back through a specific rule to a specific click and a specific payment.

3. The loop

Click, identity, revenue, attribution, action.

1. Capture Click ids, UTMs and consent, on your own subdomain
2. Identity Email and phone hashed at the front door
3. Revenue Jobs, invoices, orders and refunds, in micros
4. Stitch Three evidence tiers inside a 90-day lookback
5. Attribute Five models, exact integer allocation
6. Write back Dry run, approval, idempotent send

Stage 1. Capture the click, on your domain

A lightweight Cloudflare Worker runs on your own subdomain, for example go.yourdomain.com, with a no-worker fallback if you would rather post directly. A one-line page snippet sends it a beacon carrying the click ids (gclid, gbraid, wbraid, msclkid, fbclid), the five UTM parameters, the Consent Mode v2 signals, and the landing URL with its query string stripped.

The worker sets no cookies, logs nothing, and answers with an empty 204. Ad-click context survives navigation in the visitor's own sessionStorage. A click with no joinable signal at all is not stored, because Trailhead keeps evidence rather than exhaust. Duplicate beacons from retries or double-fires collapse into one click by construction.

Stage 2. Turn contact into identity

Leads arrive from your forms, your call tracking or Zapier through HMAC-signed webhooks. At the front door, Trailhead hashes what identifies a person, email lowercased and phone in E.164, both SHA-256, and keeps only the hashes for matching. Raw request bodies are never persisted. A field-allowlisted archive is kept for audit. Webhook retries deduplicate at the database, so replays cannot double-count.

Stage 3. Bring in the revenue

Real outcomes enter two ways, both shipping today.

• CSV upload for any system that can export. Uploads commit atomically, so a bad row cannot half-import a file.
• Webhook or Zapier for systems that push. Field-mapping templates for common shapes, including ServiceTitan exports, Shopify, Magento and generic CRM closed-won, configure the receiver in a few clicks.

Money is coerced to integer micros on the way in or rejected, never silently mangled. Refunds are first-class outcomes and flow through attribution with their sign intact.

Stage 4. Stitch, where revenue meets click

The stitch engine joins outcomes to leads by three tiers of evidence, strongest first: click id, then phone hash, then email hash. The window is a 90-day lookback plus a one-day grace for clock skew. Every match records which tier made it, so you always know how solid a number is.

What does not match stays visible as unmatched. There is deliberately no "same afternoon, probably the same person" tier, because time-window-only matching is attribution by hope. The stitch is deterministic and recomputable. Run it again and you get the same answer. Run it after new data and it extends cleanly.

Stage 5. Attribute, five models, exact math

With revenue joined to its touchpoint path, Trailhead computes attribution under five standard models side by side: last-touch, first-touch, linear, time-decay with a 7-day half-life, and position-based at 40/20/40. Switching is one click and comparing them is a table, because the interesting finding is usually where the models disagree.

Allocation is integer micros with largest-remainder rounding, so per-channel revenue sums exactly to attributed revenue. Spend is prorated to the reporting window by day overlap. Channel resolution is deterministic: click-id type first, then UTM alias, otherwise direct. Unattributed revenue lives in its own honest bucket and is never smeared across channels to make ROAS look complete.

4. The working surface

• Dashboard. Revenue, attributed against unattributed, spend, blended ROAS and match rate as headline tiles. A daily chart. Channel, campaign and model-comparison tables. An inline spend editor, and a one-click standalone HTML export you can send to anyone. An optional analyst layer writes the plain-language read-out, and the numbers it cites come from the engine rather than from the model.
• Live feed. Clicks and leads arriving in near-real time with type and consent badges. The fastest way to confirm capture is wired correctly.
• Outcomes. Revenue summary with stitch-tier badges, source management, CSV upload and a one-button stitch run.
• Reconciliation. Trailhead's numbers next to each platform's claims. Per-platform truth, a labelled blended view carrying an explicit double-count warning, an alignment ratio, and a deterministic data-hygiene score out of 100 built from four weighted components. When there is not enough data to score, it abstains and says why. An absent number, not a fake zero.
• Write-back. The review pipeline described below.
• Team and workspace. Four roles, member management, and self-service password change.

5. Write-back

Smart bidding optimizes toward whatever conversions it is given. Give it form-fills and it buys form-fills. Give it banked revenue and it buys customers. Trailhead's write-back exists to close that loop, and it is built deliberately backwards from most tools: review first, transmit second.

1. Dry-run plan. Trailhead assembles the exact per-platform payload and shows you every candidate and every exclusion, each with its reason.
2. Hash-bound approval. Approving locks the plan by content hash and by connector-config digest together. Change anything, the dataset, the account, the conversion action, and the approval is void. What you approved is exactly what can go, or nothing goes.
3. Idempotent send. Every conversion carries a per-outcome idempotency key in a permanent ledger. Renaming an action, retrying a batch or re-running a plan cannot re-transmit a conversion.

6. The suite

Trailhead is the middle of three products. TrailMap analyzes what the platforms claim, turning spend, impressions and platform-reported conversions into a prioritized action plan. Trailhead establishes what actually happened. Outfitter is the execution layer that pushes changes to live ad accounts behind an approval gate. Run TrailMap and Trailhead together and you get the number neither produces alone: the gap.

On the Suite page, connected customers can today:

• Import claimed spend and conversions from TrailMap by paste, file upload or a fetch URL.
• See the leakage table: claimed CPA against true CPA, true ROAS, and the conversion gap, channel by channel, beside totals that are correct in every case. When the two channel sets do not overlap, the per-channel rows cannot join and the totals are the number to read.
• Mint a revenue-truth key, a scoped show-once API key exposing Trailhead's attributed-revenue feed, channel by month in integer micros, for TrailMap and other consumers to pull. The key is stored hashed and the endpoint answers only with it.

Hands-off background synchronization between the two products is the next step on the suite roadmap. The import and export surfaces above are how connected customers close the loop today. The link between Trailhead and Outfitter is sequence rather than plumbing: the two products do not exchange data, and that work is planned rather than built. There is a fuller account on the suite page.

7. Data handling and trust

• Multi-tenant isolation, enforced once and everywhere. Every query is tenant-scoped through a single dependency, and cross-tenant access returns 404 rather than confirming whether the thing exists.
• Authentication. argon2id password hashing, uniform failure responses with no timing or enumeration oracle, rate-limited login and registration, and revocable database-backed sessions stored only as SHA-256 hashes.
• Roles. Owner, admin, analyst and viewer, with guards against privilege self-escalation and against removing a workspace's last owner.
• Credentials are write-only. Connector secrets and webhook HMAC keys are Fernet-encrypted at rest with rotation support, and no endpoint ever returns one.
• Personal data is hashed at ingress. Matching uses SHA-256 hashes of normalized email and phone. Raw bodies are never persisted, and landing URLs are stored without query strings.
• Privacy operations are built in. Per-person erasure, and full workspace purge behind a typed-name confirmation.
• Production preflight refuses to boot misconfigured. Missing secrets, a weak admin key, insecure cookies or a non-production database stop the deploy loudly.
• Consent-aware by design. Consent Mode v2 signals are captured with every click and carried through the pipeline.

The security page is the fuller reference, including the gaps.

8. Pricing

During early access, billing is handled directly with our team rather than through self-serve checkout. Full detail on the pricing page, including what is deliberately not a paid tier.

9. What Trailhead does not do yet

The same honesty the product applies to your numbers, applied to itself.

• Live conversion transmission is being switched on per account. Write-back currently runs in review-first sandbox mode. The senders go live account by account as verification against real accounts completes.
• No dedicated CRM API integrations yet. ServiceTitan, Shopify and Magento are supported through their exports and webhooks via mapping templates, not by direct API pull.
• One attribution family. Five deterministic models ship today. A data-driven model is deliberately deferred until there is enough volume to make it honest.
• Team invites hand you a one-time temporary password to deliver yourself. Email delivery is coming.
• Single sign-on is on the enterprise track, not shipped.
• TrailMap exchange is import and export today, not a background two-way feed.

10. Getting started

1. Create your workspace and run the guided setup.
2. Wire capture. Deploy the capture worker on a subdomain you own, or use the direct-post fallback, and add the page snippet. Watch clicks appear in the live feed.
3. Connect leads. Point your form, call and Zapier webhooks at your signed ingest URL.
4. Bring revenue. Upload your first outcomes CSV or connect an outcome webhook.
5. Run the stitch, pick a model, read your first true-ROAS dashboard. Export the HTML report and put it next to what the platforms told you.

The gap between those two documents is why Trailhead exists.