7 300 / s
clicks per second, measured
Self-hosted · Go · ClickHouse
A tracker that decides who is in front of it before the redirect fires.
Traffic filtering, stream routing and postbacks on a single engine. Deployed with your own docker compose, data never leaves your perimeter, config reloads on the fly.
Requires your own server. No SaaS, no shared database, no third party sitting between you and your traffic.
stream up
4 passed3 blocked1 white
| Time | Visitor | Verdict | Route |
|---|---|---|---|
| 14:22:07 | 176.32.14.9 · DE · Android 14 | PASS | money |
| 14:22:07 | 52.14.220.4 · US · Datacenter | BOT | 404 |
| 14:22:08 | 91.108.5.61 · UA · iOS 17 | PASS | money |
| 14:22:08 | 34.90.11.77 · NL · Azure | ISP | 404 |
| 14:22:09 | 188.43.9.120 · RU · Desktop | GEO | white |
| 14:22:09 | 37.115.2.8 · UA · Android 13 | PASS | money |
| 14:22:10 | 20.55.19.3 · US · Palladium | RBL | white |
| 14:22:11 | 46.211.88.4 · UA · Android 14 | PASS | money |
Every click is scored by the stream filters, then routed. What you see here is the shape of the real log line: time, visitor, verdict, destination.
33
filter types out of the box
91
report dimensions
< 2 s
config propagation
What the engine does
Six things you will use every day. The full list is on the features page.
01 / Filters
Filters and anti-bot
Geo, ISP, device type, proxy, referrer, language, IP lists, bot signatures. Palladium and Adspect plug in as ordinary stream conditions.
02 / Routing
Streams with priority
Forced streams first, then regular ones by weight, then default. Actions: redirect, serve local HTML, return 404, hand over to another campaign.
03 / Offers
Multi-offer with weights
Split traffic across offers by weight inside a stream. Click caps and conversion caps stop a stream when it hits the number you set.
04 / Postback
S2S in both directions
Accept conversions with parameter aliases shaped to your network, then relay them to the source with retries. One conversion per click, status changes rewrite the report.
05 / Reports
ClickHouse report builder
Two-level grouping with subtotals, drill-down by clicking a value, custom metrics from a formula, click-date or conversion-date basis.
06 / Team
Group isolation
A buyer sees only their own campaigns, offers and reports. The root account is protected by database triggers, not just by the interface.
The main difference
Anti-bot is part of the tracker, not a second subscription.
Binom sells bot protection as a separate product on top of the licence. Keitaro gives you built-in filters but leaves external anti-fraud to your own wiring. In TrafMate, Palladium and Adspect are filter types in the same list as geo and device - you add them to a stream and set accept or reject.
White page or 404
Crawlers, datacenter ranges, proxies, wrong geo.
Landing and offer
A live visitor from the geo, device and carrier you paid for.
Most used of the 33 filter types10
- Bot signature database (IP, user agent, fingerprint)
- Country, region and city by IP
- ISP and carrier - cuts datacenter ranges
- Device type, OS, OS version, browser
- Proxy and VPN detection
- Referrer, empty referrer, URL parameters, sub_id
- Browser language
- IP allow and deny lists
- Palladium (rbl.palladium.expert) as a native filter
- Adspect stream UUID as a native filter
Try it
Set the visitor, watch the verdict.
The same filter chain the engine runs on every click, with the same order: a reject rule wins the moment it matches. Change the visitor and the route changes with it.
Visitor
Country
Device
Network
Referrer
Anti-fraud
Filter chain5
- country · accept UA, DE, PLpassed
- device_type · accept mobilepassed
- isp · reject datacenterpassed
- empty_referrer · rejectpassed
- paladiumklo · reject on hitpassed
MONEY
Landing, then offer. This is the visitor you paid for.
A simplified model of five filters out of the fifteen the engine ships with. In the panel each rule is a row on the stream, and you set accept or reject yourself.
Teams
Buyers do not see each other's work.
Access is limited by two independent layers: which sections a user can open, and which entities they can see inside them. Group isolation means a buyer's campaigns, offers, landings and reports are theirs alone.
Two roles
Admin has everything. A buyer gets exactly what ACL allows - nothing else appears in the interface or in the API.
Protected accounts
The root account cannot be deleted, paused or stripped of admin. Enforced by database triggers, so direct SQL cannot break it either.
API keys
Per-user keys for the admin API. Revoke one without touching the rest of the team.
Sources and services
What connects today, and what is still on the roadmap. We list both, because a tracker page that hides the roadmap is a tracker page you cannot trust.
Working now12
- Palladium anti-fraud
- Adspect anti-fraud
- Incoming postbacks from any network (parameter aliases)
- Outgoing S2S with macros and retries
- Let's Encrypt on-demand TLS for campaign domains
- MaxMind GeoIP databases
- Facebook Conversions API, packaged
- TikTok Events API
- Google Ads offline conversions
- Cloudflare domain connection in one click
- Conversion import from a file
- Bot list management in the interface
On the roadmap1
- Namecheap domain automation
Namecheap is the only one left, and it sits in the backlog until a customer asks for it. Domains connect through Cloudflare in one click today.
What plugs inLivePlanned
PalladiumAnti-fraud
AdspectAnti-fraud
MaxMindGeoIP
Let's EncryptTLS
FacebookS2S macros
TikTokS2S macros
BigoS2S macros
KadamS2S macros
MintegralS2S macros
Facebook CAPIOne-click
Google AdsOffline conv.
CloudflareDomains
NamecheapDomains
Sources marked S2S macros work today through postback URLs with macros. The one-click packaged setup for Facebook CAPI, Google Ads and Cloudflare is still on the roadmap.
Architecture
Written for the hot path.
The click engine never queries PostgreSQL while a visitor waits. It holds campaigns, streams, filters, offers and domains in memory and refreshes them in the background. Analytics is written asynchronously through a Redis stream, so recording a click cannot slow down the response.
trafficGo
Click intake, filters, routing, redirect, incoming postbacks
workerGo
Redis stream to ClickHouse in batches, outgoing S2S with retries
adminGo + SPA
CRUD, dashboard, report builder, ACL, tracking tools
landerFrankenPHP
Local landing pages and PWA templates with macros
PostgreSQL16
Configuration of every entity
ClickHouse25
Clicks, LP clicks, conversions
Redis7
Queue, uniqueness, sticky visitor, verdict cache
Caddy2
Reverse proxy, automatic TLS for campaign domains
Installation
One command on a clean server.
curl -fsSL https://get.trafmate.com/install.sh | sudo bashDebian 12 or Ubuntu 22+. Nothing to log into: compose and the Caddyfile are embedded in the script, and the panel asks for your licence key on first sign-in. It installs the current stable version rather than latest, so the result is reproducible and can be rolled back.
How we sit against Keitaro and Binom
Short version. The full table, including what we do not have, is on the comparison page.
| How we sit against Keitaro and Binom | TrafMate | Keitaro | Binom |
|---|---|---|---|
| Anti-bot | Palladium and Adspect native, included | Built-in filters, external anti-fraud on your own | Separate paid product |
| Users | Unlimited, isolated by group | 1 to 5 depending on plan | Unlimited, no group isolation |
| Landing pages | File editor in the panel, PHP sandbox, existing pages move as-is | Editor on higher plans | Host them yourself |
| Hosting | Self-hosted only | Self-hosted | Self-hosted or cloud |
Pricing
Clicks are never counted - not on any plan, ever. Domains are, generously: the tier that matches yours at Keitaro gives you a fraction of them for more money.
SoloDraft
$59/mo
One buyer running their own campaigns
TeamDraft
$129/mo
A team of buyers with separated work
ScaleDraft
$199/mo
A team that outgrew the Team ceiling
AgencyDraft
$299/mo
An agency running traffic for clients
Questions we get asked
Is there a cloud version?
No. TrafMate is self-hosted only. You run it with docker compose on your own server, and the click data never leaves it. That is a deliberate choice for this product, not a stage we are passing through.
What server do I need?
For a few million clicks a month, a machine with 8 CPU cores, 16 GB of RAM and NVMe storage is comfortable. ClickHouse is the component that wants the disk. We will size it with you before you buy.
Do you install it for me?
Yes, and it costs nothing. You give us a clean server, we bring up the stack, point the domains and hand over the admin account. Included on every plan, including Solo.
Can I move from Keitaro without losing history?
Yes. Campaigns, streams, filters, offers, landings, traffic sources, users and click history are migrated. Our own migration moved 2 274 973 clicks with the reports matching afterwards.
Will my existing landing pages work?
Yes. The lander service runs PHP 8.3 under FrankenPHP and serves local pages and PWA templates with the same macros, so pages built for Keitaro do not need rewriting.
Do you take a cut of my traffic or see my data?
No. There is no phone-home, no shared database and no traffic passing through us. The only outbound calls the tracker makes are the ones you configure: anti-fraud lookups, postbacks and TLS issuance.
What is a bot filter going to cost me on top?
Nothing on our side. Palladium and Adspect are third party services with their own pricing - if you already pay for one, you plug in the credentials and it works as a filter.
What is missing compared to Keitaro?
Packaged ad-network integrations, conversion import from a file, traffic simulation, bot list editing in the interface, global search and archive with TTL. All of it is listed on the comparison page rather than hidden.
Put it on your own server.
Buying takes a couple of minutes: pick a plan, pay, and the key arrives by email. Installation is a single command on your server.