Privacy, SKAN and compliance
How to score an MMP on privacy: SKAN 4 and AdAttributionKit support, SOC 2 Type 2 and ISO 27001 certification, and whether raw data can stay in your own cloud.
Check three things: that the MMP documents SKAN 4 (and ideally AdAttributionKit) on the plan you are buying, that it states both SOC 2 Type 2 and ISO 27001, and whether raw events can stay in your own cloud if your legal team needs that.
What does privacy mean when choosing an MMP?
For an MMP, privacy covers how iOS installs are measured without user-level tracking, how securely the vendor handles your data, and where that data is stored.
SKAN (SKAdNetwork): Apple's privacy-preserving install attribution for iOS. Ad networks receive delayed, aggregated postbacks instead of device IDs. SKAN 4 added three postbacks and coarse conversion values. See the glossary entry.
Why does SKAN 4 support matter?
Most iOS users do not opt in to tracking, so SKAN is the main signal for iOS paid campaigns. A vendor should document SKAN 4 setup, conversion value schemas and how ad networks read them.
- Documented SKAN 4: Linkrunner, AppsFlyer, Adjust, Branch (with its Ads product enabled), Singular and Kochava.
- Partly: Airbridge documents SKAN 4 settings on its Growth plan; Tenjin and AppMetrica document SKAN but do not state SKAN 4 support.
Apple's newer AdAttributionKit runs alongside SKAN. Ask whether the vendor already receives AdAttributionKit postbacks, and for which ad networks.
Which certifications should an MMP have?
SOC 2 Type 2: an audit of how a company's security controls worked over a period, usually 6 to 12 months. ISO 27001: a certified information security management system.
Procurement teams at larger companies often require both. The scorecard marks a yes where the vendor states both:
- Both stated: Linkrunner, AppsFlyer, Branch, Singular, Airbridge and Tenjin.
- One stated: Adjust and AppMetrica (ISO 27001; SOC 2 not published), Kochava (SOC 2 Type II; ISO 27001 not confirmed on its site).
Certificates expire, so ask for the current report and its dates rather than relying on a badge.
Can data stay in your own cloud?
A self-hosted or bring-your-own-cloud (BYOC) option keeps raw events and personal data inside your own cloud account. It matters to banks, health apps and teams with strict data residency rules, and to few others. Linkrunner offers BYOC on its Enterprise plan (Google Cloud first, AWS planned). None of the other eight vendors publishes a self-hosted option; that is marked as not published, not as a no.
If you process Indian users' data, our sister site explains what India's DPDP Act expects from SDKs and processors.
How do the nine MMPs mark on privacy, skan and compliance?
Vendors A to Z, from each vendor's own pages, checked 2 Nov 2026.
✓Yes ½Partly ✗No ?Not published
| Requirement |  Adjust |  Airbridge |  AppMetrica |  AppsFlyer |  Branch |  Kochava |  Linkrunner |  Singular |  Tenjin |
|---|---|---|---|---|---|---|---|---|---|
| SKAN 4 support | ✓YesAll SKAN versions; SKAN 4 from SDK 4.33.0 source | ½PartlySKAN 4 settings documented; SKAN on the Growth plan source | ½PartlySKAdNetwork tracking documented; SKAN 4 not stated source | ✓YesSKAN 4 supported; SKAN Conversion Studio source | ✓YesSKAN 4 supported once the Ads product is enabled source | ✓YesSKAN 4 settings documented; SKAN and AAK on every plan source | ✓YesSKAN 4.0 wizard and AdAttributionKit, every plan source | ✓YesSKAN attribution listed on the Free plan source | ½PartlySKAN free for all customers; SKAN 4 not stated in its docs source |
| Enterprise compliance | ½PartlyISO 27001:2022 stated; SOC 2 not published source | ✓YesSOC 2 Type II and ISO 27001 stated source | ½PartlyISO 27001 stated; SOC 2 not published source | ✓YesISO 27001:2022 certificate; SOC 2 Type II stated source | ✓YesSOC 2 Type II and ISO 27001 in its trust centre source | ½PartlySOC 2 Type II stated; ISO 27001 not confirmed on its site source | ✓YesISO 27001:2022 and SOC 2 Type 2, plus GDPR source | ✓YesSOC 2 and ISO 27001 stated (SOC 2 type not stated) source | ✓YesSOC 2 and ISO 27001 listed on the pricing page source |
| Self-hosted option | ?Not publishedNot published | ?Not publishedNot published | ?Not publishedNot published | ?Not publishedNot published | ?Not publishedNot published (hosted on AWS) source | ?Not publishedNot published | ✓YesBring Your Own Cloud on Enterprise (GCP first, AWS planned) source | ?Not publishedNot published ("private cloud deployments" listed, not defined) source | ?Not publishedNot published |
What should you ask vendors?
SKAN 4 support
- Do you support SKAN 4 (three postbacks, coarse values, lockWindow) and AdAttributionKit today?
- How is the conversion value schema set up and changed, and can ad networks read it?
- Which plan includes SKAN reporting?
Enterprise compliance
- Share your current SOC 2 Type 2 report and ISO 27001 certificate, with their validity dates.
- Where is our data stored and processed, and which sub-processors handle it?
- How do you handle consent signals, deletion requests and PII hashing?
Self-hosted option
- Can raw events and personal data stay inside our own cloud account? On which plan, and at what cost?
- Which cloud providers do you support for a self-hosted or BYOC deployment?
The full RFP template has every question in one list.
Questions
Do all MMPs support SKAN 4?
Six of the nine MMPs here document SKAN 4 support. Airbridge documents it on its Growth plan, while Tenjin and AppMetrica document SKAN without stating SKAN 4, so ask them directly.
Is a self-hosted MMP worth it?
Only if your legal or security team requires raw data to stay in your own cloud. It adds a cloud bill and some setup work, so most growth teams weight it at 0 or 1.
What is the difference between SOC 2 Type 1 and Type 2?
Type 1 checks that security controls are designed properly at one point in time. Type 2 checks that they worked over a period, which is why procurement teams usually ask for Type 2.
What is an MMP scorecard?
An MMP scorecard is a weighted list of requirements used to compare mobile measurement partners. Each vendor is marked yes, partly, no or not published on each requirement from its own published facts, and the weights decide the final score.
What questions should I ask MMP vendors in an RFP?
Ask about the all-in cost at your volume, which plan each feature sits on, raw data exports, SKAN 4 support, deferred deep linking, seats, security certifications and support response times. The MMP RFP template on this site has the full list, free to copy.
What does Not published mean on this site?
It means the vendor's own pricing page, docs or trust centre did not state the fact when it was checked. It is not a no: the scorecard shows it as a question mark and adds it to your RFP questions.
Other criteria
- Pricing and costPublished pricing, free plan, low price at your volume, fraud protection included. What the MMP costs at your volume, whether you can start free, and which features cost extra.
- Deep linking and channelsDeferred deep linking, web-to-app attribution, ctv attribution. Deferred deep links, web-to-app journeys and connected TV.
- Data, exports and integrationsUnrestricted data exports, warehouse delivery, large partner ecosystem. Getting raw data out, into your warehouse, and how many partners the MMP already talks to.
- Agencies and teamsUnlimited seats, agency multi-client access. Seats for the whole team and access for the agencies that run your campaigns.
- Support and regionIndia support, long market track record. A team in your region and how long the vendor has been in the market.