Stop bad ads before they render. Know exactly what it cost you.

Publishers do not, in our experience of this market, complain that their vendor misses malware. They complain that they cannot see what blocking cost them, cannot find out why an advertiser was stopped, and cannot get a straight answer about what the tag does to their page. Those are the three things we commit to publicly.

Because of how the impression is counted. Google Ad Manager counts an impression on begin-to-render. If a malicious or policy-violating creative is stopped before it renders, no impression was counted, nothing was earned, and therefore nothing was lost. If it is stopped after it renders, the publisher has been paid — but the creative's code has already executed in the reader's browser, which is the part that actually does harm. Pre-render blocking is not simply the safer option; it is the economically correct one. PubTrust's first detection layer reads bid metadata and the winning bid's creative markup before the browser paints anything.

Two different kinds of problem, caught by different machinery. The first is policy: ads for categories you do not want on your inventory — gambling, adult, crypto-investment scams, rogue pharmacies, weapons retail, political advertising you must disclose, and the deceptive low-quality creative that damages a premium site. The second is behaviour: ads that misbehave at runtime regardless of what they advertise — forced redirects, pop-unders, autoplay audio, document.write hijacks, CPU-hogging creatives. Policy is enforced by 16 Protection Packs in 14 languages. Behaviour is enforced by Runtime Integrity, which is on by default on every site and needs no keywords at all.

Authored natively, language by language. PubTrust ships 12,034 rules across 16 packs and 14 languages — en, de, fr, es, it, pt, nl, sv, da, no, fi, pl, cs, tr — and each language file is written against the vocabulary that market's advertisers actually use, with its own regulatory context and its own false-friend hazards documented in the file. A translated English list would be worse than useless here: Swedish spel, Danish spil, Norwegian spill, Finnish peli, Polish gra, Czech hra and Turkish oyun all mean "game" in every ordinary sense — football, video games, a play — and weighting any of them as a gambling term would block a sports desk's own coverage. Every Nordic gambling rule in our corpus is therefore a compound, never a bare stem.

The strongest signal in German gambling advertising is not the word "casino". It is Glücksspiel kann süchtig machen — the mandated warning, which appears in the advertising and essentially nowhere else.

→See the 14-language coverage in detail

Nothing is blocked. Every new site starts in Monitor mode: PubTrust watches, judges and reports, but does not stop anything. You look at a week of your own violations, on your own inventory, with the estimated revenue impact of each one already calculated — and then you decide, policy by policy, what to enforce. This is the default because the expensive failure in this product is not a miss, it is a false positive against a legitimate advertiser. You should not have to take our calibration on faith.

It can read everything and draft policy; it cannot switch enforcement on. PubTrust ships an MCP server at app.pubtrust.cc/mcp with OAuth 2.1. An agent can query metrics and trends, drill into violations, inspect sites and packs, generate reports, and author policies — adding keywords, domains and URL patterns, or proposing terms back into a pack. What it cannot do is flip a policy from Monitor to Block, or touch billing. Those create a pending approval that a human clicks in the dashboard. Every agent action is audit-logged with the agent's identity kept distinct from the person's.

Cross-origin creatives are opaque to JavaScript, and no vendor can change that. When a creative renders inside a SafeFrame or any cross-origin iframe, its document is unreadable from the page — contentDocument returns null — and it cannot be screenshotted from the page either, by four independent mechanisms in the browser. Any vendor describing client-side capture of cross-origin creative content is describing something browsers do not permit. What we read instead is the bid markup where header bidding supplies it, the iframe src and name attributes, and the sandbox flags and geometry — and a gambling creative’s markup almost always names a gambling host. Where a rendered image of a creative is genuinely needed, we capture it server-side, in a headless browser, where we are the browser and the boundary does not apply. Redirect chains are followed the same way.

PubTrust is a ClearTrust product. ClearTrust builds governed, auditable infrastructure for teams that have to explain their systems to somebody — a regulator, a board, a client, a reader. The same commitments run through all of it: append-only audit trails, explicit data retention, no silent impersonation, and no claim we cannot evidence.

→cleartrust.cc