All Vendors
attribution

SegmentStream

SegmentStream is an AI-driven marketing attribution vendor that models conversions using first-party data and machine learning, creating persistent cross-device identity graphs that bypass traditional cookie-based tracking limitations.

87 IOCs1 detections1 sites
85
Vendor Risk Score

How This Briefing Works

This report opens with key findings, then maps the gaps between what SegmentStream discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.

Key Findings

Key Findings

1 detection across 1 site
Disclosure Gaps

Claims vs. Observed Behavior

2 gaps

pending

MEDIUM
They Claim

“AI-powered attribution accuracy”

Observed Behavior

Awaiting scanner verification of runtime JavaScript behavior, data collection endpoints, and cookie patterns

pending

MEDIUM
They Claim

“First-party data only”

Observed Behavior

Cross-device identity resolution methodology needs direct observation to assess fingerprinting techniques

Customer Impact

What This Means For You

Organizations using SegmentStream face three primary risks: (1) Measurement dependency — once attribution models are tuned to SegmentStream's probabilistic methodology, switching providers requires re-baselining all marketing performance benchmarks, creating vendor lock-in. (2) Compliance exposure — cross-device identity resolution without clear user consent creates GDPR and CCPA liability that falls on the data controller (the customer), not SegmentStream. (3) Budget misallocation — decisions made on modeled rather than observed conversions can systematically over- or under-invest in channels based on model bias rather than actual performance.
Recommended Actions

What To Do About It

Role-specific actions based on observed behavior

Recommended Actions for SegmentStream

  • →- Audit SegmentStream's JavaScript snippet deployment to understand exactly what first-party data is being collected and how cross-device identity graphs are constructed. - Review consent mechanisms to ensure users are explicitly informed about and consenting to cross-device and cross-browser identity resolution. - Request documentation on what percentage of attributed conversions are modeled vs. directly observed, and establish internal thresholds for acceptable modeling ratios. - Evaluate whether data processing agreements adequately cover probabilistic identity resolution and international data transfers. - Establish parallel measurement using a privacy-respecting analytics tool to validate modeled attribution against directly observed behavior.

Negotiation Leverage

  • →Leverage: SegmentStream's value proposition depends on customers trusting its AI-modeled conversions — ask for transparency on model accuracy rates, false positive rates, and how modeled conversions are validated against ground truth. The cross-device identity resolution capability creates compliance liability for you as the data controller; negotiate for explicit indemnification clauses covering regulatory actions related to probabilistic identity matching.
  • →Key questions: What specific data points feed the cross-device identity model? What is the retention period for visitor-level behavioral data? How are modeled conversions distinguished from observed conversions in exported reports? What happens to collected data if the contract is terminated?
  • →Contractual protections: Require data deletion upon contract termination with certification. Include audit rights for data processing activities. Negotiate for the ability to disable cross-device identity resolution while retaining single-session attribution. Ensure the DPA explicitly covers AI-based identity inference as a processing activity.
Runtime Detections

Runtime Detections

5 BTI-C CODES

BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.

BTI-C01Defeat Device

Evasion infrastructure, auditor bypass

Impact: SegmentStream's conversion modeling creates a measurement layer where modeled conversions blend with observed conversions, making it difficult to distinguish actual customer behavior from AI-inferred behavior. Budget decisions driven by modeled attribution can create feedback loops where spending increases in channels the model favors, regardless of actual performance.

BTI-C08Cross-Domain Sync

Identity stitching

BTI-C10Fingerprinting

Device identification

BTI-C13Persistence Mechanisms

Long-lived identifiers

BTI-C14Identity Resolution

PII deanonymization

IOC Manifest

IOC Manifest

87 INDICATORS

Indicators of compromise across 3 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.

TRACK
*segmentstream.com/assets/js/vendor.js*
Tracking script
TRACK
*segmentstream.com/assets/js/main.js*
Tracking script
TRACK
*cdn.segmentstream.com/js/segmentstream.js*
Tracking script
TRACK
segmentstream.com/assets/js/vendor.min.js
Auto-extracted from scan
TRACK
segmentstream.com/assets/js/main.min.js
Auto-extracted from scan
TRACK
cdn.segmentstream.com/js/segmentstream.min.js
Auto-extracted from scan
Ecosystem

Ecosystem & Supply Chain

SegmentStream integrates with major CRM platforms including Salesforce, HubSpot, Pipedrive, AmoCRM, and RetailCRM — creating bidirectional data flows where attribution data enriches CRM records and CRM conversion data feeds back into attribution models. The platform also connects to ad platforms (Google, Meta, LinkedIn) to both import cost data and export modeled conversion signals. This creates a data supply chain where SegmentStream sits as an intermediary between advertising platforms and CRM systems, with access to both behavioral web data and downstream revenue outcomes. The platform exports data to international third parties, with transfers outside the UK governed by standard contractual clauses.
Evidence

Evidence Artifacts

Artifacts collected during analysis, available with evidence-tier access.

HAR Capture

Complete network capture with all requests and responses

IOC Manifest

87 detection signatures across scripts, domains, cookies, and network endpoints

Vendor Details