Desktop install safety and fraud — GHAN's standard

The direct answer on installer bundling

No, it is not safe, and the reason is mechanical.

An installer is a sequence of screens whose purpose is to be clicked through. A third-party offer placed in that sequence is not competing for a considered decision; it is competing for a reflex. That makes every increment of ambiguity between "continue" and "accept" worth money, and ordinary A/B testing finds that ambiguity without anyone intending to deceive.

Antivirus vendors do not evaluate intent. They classify behaviour, and software arriving through an install flow a person did not deliberately choose is the defining behaviour of a potentially unwanted program.

The decisive detail is that the detection attaches to the SDK, not to an individual offer. So the developer who integrated carefully, explained every offer and pre-checked nothing gets the same detection as the worst actor in the network. That is why the category emptied rather than shrank. Full history: why install networks die.

GHAN's safety standard, in writing

Consent

• The SDK emits no telemetry while the host application reports consent as false. Data buffered before consent is discarded, not flushed.
• A templated card may still render without consent, because rendering a card is not processing personal data. The host application can gate that too.
• The host application is the controller; GHAN is the processor. Terms: DPA.

Disclosure

• Placements are visibly a recommendation of another application, with the partner's name and icon.
• A dismiss affordance is always present.
• Nothing is pre-selected, because there is no selection control — there is a card and an Install button.

Uninstall

• Clicking Install opens the partner's own download URL. The person completes the partner's own installer, or does not.
• GHAN never installs, modifies or removes software.
• Removing a partner application has no effect on the host application, and uninstalling the host removes the SDK with it.

Prohibited installer behaviour

None of the following is permitted, and none of it is technically possible through the SDK:

1. Any placement inside an installer or uninstaller process.
2. Pre-checked or pre-selected offers of any kind.
3. Silent, background or automatic installation of any software.
4. Placements that imitate a system dialog, an error, or an update prompt.
5. Partner-supplied HTML, JavaScript, images beyond the icon, or any remote markup.
6. Modifying, wrapping or reimplementing the SDK's rendering or attribution behaviour.
7. Bundling a GHAN partner's binary into your own distribution.

The definition of a cleared install

A cleared install is an install that was attributed by a valid, unexpired, single-use signed token, claimed by the receiving application with its own ed25519 signature, and still present and in use 48 hours after the claim.

Pairs trading above EUR 500 per day with each other clear on day-7 engagement instead — a stricter bar applied exactly where the incentive to cheat is largest.

Advertisers are billed for cleared installs and nothing else. Impressions and clicks are never billed.

Every rejection and reversal condition

#	Condition	Stage	Reason code family	Effect
1	Token expired	Claim	fraud_token_expired	Reject, refund hold
2	Token already used	Claim	fraud_token_reused	Reject, refund hold
3	Token unsigned or signature invalid	Claim	fraud_token_invalid	Reject, refund hold
4	Receiving signature missing	Claim	fraud_unsigned_claim	Reject, chain cannot advance
5	Virtual machine or hypervisor indicator	Claim	fraud_vm_detected	Reject, refund hold
6	Operating system installed under 48 hours ago	Claim	fraud_fresh_os	Reject, refund hold
7	Hardware hash already seen on another claim	Claim	fraud_duplicate_device	Reject; 3+ from one partner throttles that partner
8	Claiming IP's autonomous system is a hosting provider	Claim	fraud_datacenter_asn	Reject, refund hold
9	Click-to-install time in an anomalous band	Post-claim	fraud_ctit_anomaly	Reject the band, flag the source
10	Not present or not in use at the 48-hour check	Clearing	not_retained	No clearing, refund hold
11	Cohort retention curve unlike the category baseline	Clearing	fraud_retention_shape	Hold clearing, manual review
12	Canary probe unanswered by the shipped build	Continuous	fraud_canary_fail	Suspend app, freeze escrow
13	Net flow between a pair exceeds its cap	Continuous	pair_cap_exceeded	Stop clearing for that pair
14	Circular flow across three or more apps	Monthly	fraud_collusion_graph	Suspend, clawback

Conditions 1–10 resolve automatically. 11–14 are reversible by an administrator. Every one is visible to the affected app through get_stats with its reason code — transparency applies to the installs you were not paid for, which is the half that usually stays hidden.

A reversal after clearing is recorded as a new ledger line (clawback). The ledger blocks UPDATE, DELETE and TRUNCATE at the database level, so nothing is ever edited away.

Why the economics matter more than the rule list

Rules alone lose, because a motivated attacker studies them. The structural defence is an inequality applied to every monetised feature before it is built:

The cost to fake an event must exceed the payout for it.

Faking one cleared install requires forging an ed25519 signature belonging to an SDK inside another company's signed binary, on a machine that does not look virtualised, from an IP that is not a hosting provider, with a plausible click-to-install time, that is then used again two days later, inside a pair whose net flow is capped at EUR 500 a month. The payout is a share of EUR 12 to EUR 50.

That inequality has already removed installer-time placements, custom creatives, probabilistic attribution and direct app-to-app targeting from the product.

Figures

GHAN is pre-launch. Nothing has traded, so there are no rejection counts, no clawback totals and no clearing rate to publish, and this page does not invent any.

What is published the month the first chains clear, generated from fraud_flags and the ledger rather than written by hand:

• Installs rejected, broken down by the fourteen conditions above
• Euros clawed back
• Apps flagged, throttled, suspended and expelled
• Network clearing rate and fraud percentage

Live figures will also be available without an account through the public get_network_stats MCP tool. Progress: status and transparency.

Methodology note

Everything above is a description of implemented or specified behaviour in the GHAN codebase, not an aspiration. The claims that are already testable — that the ledger cannot be edited, that a chain cannot advance with one signature, that geo and ASN resolution happens offline — have tests that run against a real Postgres instance before merge. The claims that depend on live traffic are marked as such on the status page.