# PubTrust > Publisher-side ad quality and malvertising protection. One JavaScript tag blocks > policy-violating and malicious ad creatives before they render, prices every block, > and explains every verdict down to the exact rule that fired. A product of ClearTrust > (https://cleartrust.cc). PubTrust is for publishers, ad networks, SSPs and publisher groups — the sell side. It is not an ad blocker (it removes a small, specific subset of creatives, not advertising) and it is not a verification vendor like DoubleVerify or IAS (those largely serve advertisers and measure; PubTrust serves publishers and blocks). ## What it does - **Pre-render blocking.** Reads Prebid.js bid metadata and `bid.adm` creative markup, plus Google Publisher Tag slot events, before the browser paints. Google Ad Manager counts an impression on begin-to-render, so a creative stopped before render was never counted and never earned — nothing is lost. - **DOM and creative inspection.** MutationObservers over ad slots, direct reads of same-origin friendly iframes, `innerText` versus `textContent` divergence as a cloaking signal, and client-side click-URL unwrapping. - **Runtime Integrity, always on, no keywords.** Forced navigation and pop-under laundering paths, `document.write` hijack, autoplay with sound, heavy-creative long-task attribution, and optional iframe sandboxing without `allow-top-navigation`. - **Server-side deep scan.** Follows redirect chains, captures creatives, classifies landing pages, and feeds confirmed verdicts back into a shared precomputed verdict cache. - **16 Protection Packs across 14 natively authored languages** (en de fr es it pt nl sv da no fi pl cs tr), with every rule weighted, language-tagged and annotated. ## What makes it different 1. Every block carries an estimated revenue impact, derived from the winning bid's CPM at the moment of decision. 2. Decision latency is measured in the tag and published in the dashboard at median and p95. As of 2026 we could find no published latency figure from any other vendor in this category. 3. Every verdict names the pack, the rule, the matched value, its weight, the detection layer and the rule's language — with a one-click allowlist beside it. 4. Monitor-first: a new site blocks nothing until a human has read real data and enabled it. 5. An MCP server lets an AI agent query, investigate and author policy — but not enable enforcement, which requires a human approval in the dashboard. ## What it cannot do — stated plainly - **It cannot read or screenshot a cross-origin creative from the page.** SafeFrames and cross-origin iframes return `null` for `contentDocument`, and client-side screenshotting is impossible by four independent browser mechanisms. Any vendor claiming client-side capture of cross-origin creative content is describing something browsers do not permit. PubTrust captures creatives server-side, in a headless browser. - **It cannot follow a redirect chain from the browser.** That happens server-side. - **It cannot intercept `window.location`.** That property is non-configurable; redefining it throws. What is reachable are the laundering paths (`window.open`, `a.click()`, `form.submit()`, `history.pushState`), and the `sandbox` attribute, which is the only mechanism that genuinely blocks top-level navigation. - **It does not support CJK or RTL languages at launch.** No Chinese, Japanese, Korean, Arabic or Hebrew keyword corpora. Language-independent protection still applies in full. - **It does not claim GARM compliance.** GARM was discontinued in August 2024 and the WFA confirmed in July 2026 that it will not restart. PubTrust reports against IAB Ad Product Taxonomy 2.0 (Gambling = 1361, cryptocurrency = 1448/1449) and IAB Content Taxonomy 3.1. - **It publishes no detection rate.** There is no MRC or IAB standard definition of a malicious creative to measure against, so any such percentage is measured against a definition the vendor chose. ## Privacy posture IP addresses are truncated at the edge before storage — IPv4 to /24, IPv6 to /48 — by default, not as an option. Country, region, city, ASN and network operator are retained. Full-IP retention is per-organisation opt-in with explicit acknowledgement and a 30-day hard cap. No cookies, no localStorage, no fingerprinting, no cross-site identifier. Violations are retained 90 days, clean impressions 30 days, aggregates indefinitely. The audit log is append-only and SHA-256 hash-chained, and staff impersonation is read-only by default, requires a typed reason, and appears in the customer's own audit trail. ## Pages - [Home](https://pubtrust.cc/): what PubTrust is and the three public commitments. - [How It Works](https://pubtrust.cc/how-it-works): the four detection layers, blocking mechanics, and the guarantees that keep the tag from breaking a page. - [Protection Packs](https://pubtrust.cc/protection-packs): all 16 packs, how weights sum to a verdict, and the IAB taxonomy mapping. - [Global Coverage](https://pubtrust.cc/global-coverage): the 14 languages and the regional regulation encoded in each — German GlüStV, Nordic monopolies and self-exclusion registers, EU DSA and GDPR, Turkish and CEE grey markets, US state-by-state. - [For Publishers](https://pubtrust.cc/for-publishers): revenue impact, false positives, page safety, upstream blocking, demand-partner evidence. - [For Ad Networks](https://pubtrust.cc/for-ad-networks): multi-tenant policy, portfolio rollout, agent surface, scale. - [Pricing](https://pubtrust.cc/pricing): three volume-based plans; protection is never disabled for a billing problem. - [Security & Privacy](https://pubtrust.cc/security): IP truncation, retention, page-safety guarantees, auditability, agent governance. - [Install](https://pubtrust.cc/docs/install): the tag, Prebid RTD module, GPT, custom stacks, CSP, verification. - [PubTrust vs GeoEdge](https://pubtrust.cc/compare/geoedge): what GeoEdge does well, where PubTrust differs, and what no vendor in this category can do. - [Glossary](https://pubtrust.cc/glossary): 53 ad quality terms defined plainly. - [FAQ](https://pubtrust.cc/faq). - [About](https://pubtrust.cc/about): ClearTrust, and the four positions PubTrust will not trade away. ## Optional - [Changelog](https://pubtrust.cc/changelog) - [Privacy Policy](https://pubtrust.cc/legal/privacy) - [Data Processing Agreement](https://pubtrust.cc/legal/dpa) - [Sub-processors](https://pubtrust.cc/legal/sub-processors) - [Responsible disclosure](https://pubtrust.cc/legal/disclosure)