Who GrowSurf is
GrowSurf is referral programme software from GrowSurf, Inc., a company incorporated in June 2019 that gives its address in Chicago, in the United States, and describes itself as bootstrapped and profitable. It names teams at B2C, SaaS and fintech companies as its customers. A programme, which GrowSurf's API calls a campaign, gives every participant their own referral link, records who referred whom and awards a reward when a goal is reached. Rewards can be single-sided, double-sided (for the referrer and the friend), milestone or leaderboard, and GrowSurf runs affiliate programmes with commissions as well.
A programme's referral trigger decides when a referral counts: at sign-up, or with Sign Up + Qualifying Action, where the referrer gets credit only once your own server confirms the action through GrowSurf's REST API. GrowSurf's guide gives a first deposit or a completed transfer as the action for consumer fintech, confirmed by your backend after your own checks. Around the API sit webhooks it can sign, a JavaScript SDK, native iOS and Android SDKs and server libraries for TypeScript, Python, PHP, Ruby and Java. Its anti-fraud system gives each participant a fraud risk level of low, medium or high. That fits a platform that decides for itself when a reward is earned, which is why GrowSurf is one of the referral programme connectors of our Rewards & referrals module.
What it does in your platform
Rewards & referrals
Gives every customer who joins your refer-a-friend programme a referral link, keeps the record of who referred whom, and counts a referral only when the platform's server confirms that the friend did what your rules ask. It tells the platform when a reward has been earned, and the ledger pays it. Your team sets the reward goals and limits in GrowSurf's Program Editor and follows each participant's referrals and rewards in its dashboard.
How the connection works
Everything goes through the platform's server. It calls GrowSurf's REST API at api.growsurf.com/v2 with an API key that never leaves the server, and it accepts GrowSurf's webhooks only with a valid GrowSurf-Signature header. GrowSurf publishes native iOS and Android SDKs but none for Flutter, so the apps show the link and the progress on their own screens, with data the server fetched.
A customer joins the programme
In the app, a customer opens Refer a friend and accepts the programme's terms. The server adds them with GrowSurf's Add participant call, POST /campaign/{id}/participant, sending their email address, the one field GrowSurf requires, and the platform's random ID as metadata. The answer carries their participant ID and their shareUrl, the referral link the app shows with a share button.
A friend opens the link
The link carries the customer's participant ID in its grsf parameter. If the friend has to install the app first, the attribution connector of the Analytics & monitoring module, AppsFlyer, Adjust, Branch or Singular, carries that value through the app store, and the app hands it to the server when the friend signs up.
The friend signs up
The server adds the friend with the same call, with referredBy set to the customer's participant ID. The programme's referral trigger is Sign Up + Qualifying Action, so the referral's status is CREDIT_PENDING and nobody has earned anything yet. GrowSurf gives the friend a fraudRiskLevel, and the platform runs its own checks against verified identities and devices.
KYC and a first card payment
The friend passes KYC and, twelve days later, makes a first card payment that settles. Both are facts in the platform's records, inside the 30 days your rules allow. Only now does the server call Trigger referral, POST /campaign/{id}/participant/{participantIdOrEmail}/ref. It can add delayInDays, from 1 to 90, to hold the credit through a refund window. The KYC result and the payment's details are not sent.
The ledger pays the reward
GrowSurf awards the referral credit, which meets the reward's goal, and posts a PARTICIPANT_REACHED_A_GOAL event to the platform. A double-sided reward sends two events, one for the customer and one for the friend, told apart by isReferrer. The platform checks the signature, credits each balance once from the marketing budget account in the Ledger, however often an event is delivered, and marks the reward as sent with POST /campaign/{id}/reward/{rewardId}/fulfill.
A refund takes it back
If the payment is refunded while the credit is on hold, the server calls Cancel delayed referral trigger, a DELETE on the same path, and nothing is paid. If a refund or chargeback comes later, the Ledger takes the credit back from both balances. GrowSurf's API removes a reward only before it is approved, so the correction lives in the platform's records, where your team sees it in the Backoffice.
Next to other providers
GrowSurf keeps the links and the count, and the platform keeps the proof and the money. KYC / AML says whether the friend is a new, verified person, Fraud & risk says whether two accounts share a device, and the Ledger pays the reward and takes it back. For links that have to open an app, GrowSurf's guides point to an attribution provider and name Branch, AppsFlyer, Adjust and Singular, the four attribution connectors of our Analytics & monitoring module. For a gift card in place of balance, the platform orders it through Runa, the module's reward delivery connector; GrowSurf also has its own integration with Tremendous, a gift card service. Your team chooses whether GrowSurf's own welcome and reward emails go out, or the Notifications module tells customers instead. Where a market's rules bar an incentive for a product, the module switches the programme off there, whatever GrowSurf is set to.
GrowSurf is one of the module's referral programme connectors, next to Referral Factory and Friendbuy. The qualifying rules, the record of who passed KYC and paid, the abuse checks and every reward entry live in the platform, so moving between the three swaps a connector and leaves your ledger and your apps' screens as they are. What stays behind is what was built in GrowSurf: the programme's rewards, goals and limits, its email templates and the participants' links, which would be set up again in the new tool. Links customers have already shared carry GrowSurf's participant IDs, and the platform keeps each one next to its own customer ID, so we plan with you how old links are honoured after a move.
When GrowSurf fits best
A strong fit when
- Your reward depends on something only your platform can prove, such as passed KYC and a first card payment, and you want the referral tool to wait for your server's word.
- You want a refund window honoured before anyone is credited: a triggered referral can be held for 1 to 90 days and cancelled in that time.
- Your growth team wants to set rewards for both sides, goals, per-customer limits and manual approval in a dashboard, with a fraud risk level on every participant next to the platform's own checks.
Also worth a look
- Referral Factory or Friendbuy, the module's other referral programme connectors, when your team already works in one of them.
- A referral tool your team already runs: its account becomes a connector too.
How we get you live
The contract
We help you get your GrowSurf account and contract in place. GrowSurf's data processing agreement is accepted together with its terms of service, and it covers transfers from the EU with the EU Standard Contractual Clauses and from the UK with the UK International Data Transfer Addendum.
The data
GrowSurf hosts its service in the United States: its production systems in DigitalOcean's San Francisco data centre and a Firebase database in Google Cloud's Iowa region. So we keep what it holds small. A participant is an email address and the platform's random ID. First name, last name, IP address and browser fingerprint are optional fields, which the platform leaves empty unless your programme shows a friend's first name. We switch on the programme's strict GDPR/CCPA mode, in which GrowSurf stores only the minimum and limits its own fraud screening. With your team we set the referral trigger, the referral credit window, the rewards and their limits in GrowSurf's Program Editor.
The keys
The API key is created with only the scopes the platform uses, such as participant:write to add participants and trigger referrals and reward:fulfill to mark a reward as sent. GrowSurf shows the full key once, and it goes straight into your platform's secrets. The webhook secret sits beside it: GrowSurf signs each delivery with HMAC SHA-256 over a timestamp and the payload, and the platform rejects a post whose signature does not match or whose timestamp is stale. The apps carry no GrowSurf key at all.
A full test run
In place of a sandbox, GrowSurf recommends a separate development programme next to the production one, each with its own ID, so test participants never mix with real customers. We run the whole case there with test customers: a link, a sign-up, KYC, a first card payment, the triggered referral, the signed webhook, the ledger credit, a refund and a deletion. GrowSurf's Test webhook call sends a test event to the platform's endpoint, signed with the stored secret, before your first real customer.
