Skip to content
All writing

September 8, 2026

Server-side attribution and identity resolution without an ORM

A sales funnel that cannot tell you which traffic drives revenue is flying blind. The funnel I was asked to instrument had a specific problem client-side pixels could not solve: the same person would opt in with one email and buy with another, and every tool involved counted them as two.

The fix was a server-side, first-party tracking system that assigns each visitor a durable identity and resolves it across the whole journey — Node.js, Express, and PostgreSQL, with raw parameterized SQL and no ORM.

First-party by design

A lightweight (~5KB) tracker sets a first-party cookie scoped to the funnel’s domain, assigned server-side. That makes the identity resistant to ad blockers and browser tracking-prevention in a way third-party pixels are not — and it is the anchor everything else hangs off.

Identity resolution and merging

When someone reappears under a new email, their profiles merge: events, emails, and purchases are reassigned to a single surviving identity, and merge chains resolve to the current one. Phone number is a fallback match key. The result is one profile per person, not one per email address.

Six payment providers, one idempotent pipeline

Purchases arrive from six different providers, each with its own payload shape, verification scheme, and quirks — and all flow through a single purchase pipeline made idempotent by a namespaced transaction ID.

  • Signature or token verification appropriate to each provider
  • Hardened against real-world messiness: multipart bodies, dashboard-created payments, and deeply nested fields
  • Enriched events forwarded server-side to the major ad platforms for attribution

Why no ORM

The system is read-heavy on reporting and write-heavy on events, with a lot of set-based identity work. Raw parameterized SQL kept the queries legible and the performance predictable, and made the merge logic — which is inherently relational — straightforward to reason about. Parameterization keeps it safe; the absence of an ORM keeps it honest.

Reporting as a first-class product

On top of the pipeline sits a 23-endpoint reporting API — funnel conversion, source attribution, webinar impact, time-to-convert, per-visitor timelines — plus a live KPI dashboard that ran during a launch event with time-based phase cutovers. Tracking is only useful if the answers are easy to reach.

The takeaway

Attribution is an identity problem before it is an analytics problem. Solve identity server-side, first-party, and idempotently, and the reporting becomes the easy part.