RTB Architecture: Guides, Comparisons and Tools

Real-time bidding connects publishers, exchanges and demand-side platforms through a time-limited auction. Engineering decisions must account for request volume, latency, state, consent, supply-chain transparency and reconciliation.

Start with the business decision and the data flow. Identify who owns the customer relationship, who receives each signal, who runs the decisioning system, and what evidence supports the result. A vendor feature list alone cannot settle those questions.

This guide brings together the reference material for this topic. Comparisons describe different operating models, rather than declaring a universal winner. The linked pages retain source dates, vendor-claim labels and the limits of each example. Read those limits before applying a figure or architecture to your own organization.

Prebid.org's own guidance is to pick the language your team prefers if the feature set and adapters you need are present in both (PBS-Go versions page, accessed 17 October 2026). In practice the choice is driven by the Java-only list: if you need the USGen module for US state privacy, the circuit breaker or per-account stored requests, pick Java; if you need the legacy schain locations or geo-fencing, pick Go.

Read the full prebid server self-hosting guide: aws, on-prem, managed guide for context, sources and limitations.

The host must handle production networking and monitoring, populate account and stored-request data, and "assess the legal implications of ad tech" in its market; no open-source tooling exists for the data pipeline that fills the stored-request database (Prebid Server hosting, accessed 17 October 2026). A multi-region deployment needs a global load balancer and a source database that replicates to each region (same). And the uids cookie that carries bidder IDs is set on the Prebid Server host's domain, so with a managed host the identity cookie belongs to the host's domain, not yours (Prebid Server cookie sync, accessed 17 October 2026).

Read the full prebid server self-hosting guide: aws, on-prem, managed guide for context, sources and limitations.

Prebid Server. CPU and network bound; needs "a fair amount of memory" to cache stored requests and several GDPR vendor-list versions; can host geo lookup for GDPR scope (Prebid Server hosting). Endpoints: /openrtb2/auction, /openrtb2/amp, /openrtb2/video, /cookie_sync, /setuid, /getuids, /status, /version, /info (Prebid Server overview).

Prebid Cache. Stores VAST and bids for video and AMP; uses "very little CPU or memory" and translates between Prebid's protocol and the backend, which can be Redis, Aerospike, Cassandra or Apache Ignite; cluster size depends on traffic volume, mix and how long objects stay cached (Prebid Server hosting).

Stored requests. Blocks of OpenRTB stored server-side and merged into incoming requests, used for mobile app and AMP and for keeping ad-unit definitions out of tags. PBS-Go supports filesystem (stored_requests.filesystem.enabled: true, files under stored_requests/data/by_id/), Postgres (stored_requests.postgres with a query) and HTTP (stored_requests.http.endpoint), with an in-memory cache (in_memory_cache.ttl_seconds, request_cache_size_bytes, imp_cache_size_bytes) and an HTTP events feed for invalidation (http_events.refresh_rate_seconds) (stored requests, Go, accessed 17 October 2026). A request references a stored imp with imp[].ext.prebid.storedrequest.id; request values win on conflict (same).

The bidder parameter names above follow the Prebid bidder docs for each adapter; the IDs are placeholders (Prebid bidder list).

Bidder adapters. Each adapter ships with a static/bidder-info/{bidder}.yaml declaring endpoint, maintainer.email, gvlVendorID (IAB Europe Global Vendor List ID), capabilities (app, site, dooh with banner, video, audio, native), userSync (iframe or redirect URL with a userMacro), openrtb.version (2.6 if supported), endpointCompression (gzip) and modifyingVastXmlAllowed (Prebid.org, adding a new bidder, Go, accessed 17 October 2026). In PBS-Java "by default all bidders are disabled" and are switched on per adapter with adapters.<bidder>.enabled (config-app.md, accessed 17 October 2026). Enable only the bidders you have contracts with; the uids cookie and the GVL ID govern what each may receive under TCF.

Cookie sync. Prebid.js sends the bidder list and privacy signals to /cookie_sync; if privacy rules allow, PBS returns sync pixels for bidders missing an ID; each bidder endpoint redirects to /setuid, which stores the bidder's ID in the uids cookie on the PBS host domain; later auctions place that ID in user.buyeruid for the bidder. userSyncLimit in s2sConfig caps syncs per call, coopSync (default true) lets PBS sync bidders not on the current page, and PBS checks TCF Purpose 1 on both /cookie_sync and /setuid (Prebid Server cookie sync; Prebid Server adapter docs; Prebid Server privacy; all accessed 17 October 2026).

Floors. Floor rules live in ext.prebid.floors on the request or stored request, or are fetched dynamically from a URL (fetch.enabled, fetch.url, fetch.period_sec default 3600, fetch.max_age_sec default 86400); enforcement rejects bids below the floor after currency and bid adjustments, and skipRate bypasses signalling for A/B tests (Prebid Server floors, accessed 17 October 2026).

Read the full prebid server self-hosting guide: aws, on-prem, managed guide for context, sources and limitations.

Sourced prices (US East, on demand, accessed 17 October 2026)

Inputs you supply (illustrative values, not benchmarks)

Formulas

Read the full prebid server self-hosting guide: aws, on-prem, managed guide for context, sources and limitations.

1. Where the data sits. Warehouse-native rooms (Snowflake, Databricks, AWS Clean Rooms) query data where it already lives. Walled-garden rooms (Google Ads Data Hub, Amazon Marketing Cloud) hold the platform's event data and let you bring yours in. Vendor-hosted rooms (LiveRamp, InfoSum, Optable, Decentriq) run the join on the vendor's infrastructure, sometimes with the data staying in each party's own cloud account.

2. Who runs the compute. In AWS Clean Rooms the "member who can query" runs the job and a configurable payer is billed (AWS Clean Rooms pricing). In Snowflake the analysis runner pays (Snowflake docs). In enclave rooms the compute is a trusted execution environment that neither party nor the cloud operator can inspect (Microsoft Learn).

3. Which privacy technique limits the output. Allowed-column lists, query approval, minimum aggregation thresholds, noise injection or formal differential privacy, and cryptographic matching so that no party holds the other's cleartext identifier. AWS offers all of these as configuration; its differential privacy went GA on 10 April 2024 (AWS What's New, 10 April 2024) and reached the Spark engine on 16 July 2025 (AWS doc history).

4. Which protocol connects the room to partners. A room that joins your data with one partner's is a project; a room that can produce PAIR IDs or accept ADMaP requests is infrastructure.

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

"n/d" means the vendor publishes nothing on that cell as of 17 October 2026; "vendor claim" marks figures from the vendor's own site.

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

The differences are structural.

Membership. AWS requires every member to hold an AWS account, although since 1 December 2024 a member's data can live in Snowflake or Athena (AWS doc history). Snowflake requires every party to be on Snowflake, with Enterprise Edition for data providers, but clouds and regions can differ (Snowflake docs).

Privacy controls. AWS is more prescriptive: analysis rules are first-class objects, minimum aggregation thresholds and comparison controls can now be set inside custom rules (13 August 2026), and differential privacy is a managed feature (AWS doc history). Snowflake controls exposure through the data offering specification and approved templates; its differential privacy capability came from LeapYear and was in preview at GA in March 2024 (InfoWorld, 28 March 2024).

Machine learning. AWS Clean Rooms ML has shipped lookalike modeling (3 April 2024), custom models (7 November 2024), incremental and distributed training (1 July 2025) and synthetic datasets (30 November 2025) (AWS doc history). Snowflake rooms run approved Python code specs (Snowflake docs).

Cost. AWS publishes worked examples: $3,504 a year for a daily three-minute Spark SQL query on 32 CRPUs, and $7,000 a week for a lookalike workflow of 50 million training profiles and ten 2-million-profile segments (AWS Clean Rooms pricing). Snowflake's application is free; you pay the warehouse that runs the analysis (InfoWorld, 28 March 2024).

Lock-in. Both keep data in place. Both also assume the counterparty is on the same platform. Databricks is the one warehouse vendor that markets collaboration with non-Databricks partners through federated sharing (Databricks, 9 June 2025).

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

ADMaP (Attribution Data Matching Protocol). ADMaP is the attribution counterpart: a privacy-safe way for an advertiser and a publisher or platform to match exposure and conversion records so that attribution can be computed without exchanging cleartext identifiers. IAB Tech Lab published v1.0 Final in February 2025 and moved the specification to GitHub in September 2025 (IAB Tech Lab, ADMaP v1.0, accessed 17 October 2026; InteractiveAdvertisingBureau/ADMAP on GitHub). A webinar replay on "Privacy Safe Secure Attribution with ADMaP" was published on 10 April 2025 (IAB Tech Lab, 10 April 2025).

Agentic enrichment is the alternative path. IAB Tech Lab's ARTF runs a partner's container inside the host's perimeter instead of exporting from a clean room; Adform and Adsquare shipped the first public integration on 27 May 2026 (ExchangeWire, 27 May 2026). See AAMP vs AdCP.

Read the full data clean room architecture: 12 providers compared (2026) guide for context, sources and limitations.

Constraint 1: CPU. Every request costs CPU time, from parsing JSON to running the model to serializing a response. Peak QPS times CPU milliseconds per request gives CPU-seconds per second, which is the number of fully busy vCPUs you need. You never run them fully busy, because tail latency rises steeply as utilization approaches 100%, so the planner divides by a target utilization (60% by default) to get vCPUs to provision, then by vCPUs per instance, then adds redundancy. The CPU cost per request is the one input only you can supply; it comes from a load test of your own bidder. If you have not measured it, the planner labels the result "unmeasured" and the AWS Prebid Server table gives an order of magnitude.

Constraint 2: time. The exchange's tmax includes network latency. Subtract the round trip to the exchange, the time the exchange's own stack takes (if you sit behind a Prebid Server or an SSP, their formula is visible in the key facts) and serialization, and what is left is your compute budget. Your p99 target must fit inside it with margin. Little's law then gives in-flight requests: QPS times average service time. Divided by instances, that is the concurrency each instance holds, which must be below its worker or connection limit. The seven architecture mistakes that slow ad tech are mostly violations of this constraint.

Constraint 3: bytes. Inbound bid requests are large and, on the two big clouds, free. Outbound bid responses are small, and no-bids are near zero if you answer with an empty 204, which the spec calls "the most bandwidth friendly form of this signal" (IAB Tech Lab, OpenRTB 2.6). Average QPS times the blended response size gives gigabytes per month, priced through the provider's tiers. Logging to in-region object storage is not internet egress and is excluded; replication between regions is priced at the inter-region rate if you enable it.

Regions. Exchanges route by geography and tmax is unforgiving across oceans, so most bidders run in at least two regions. The planner sizes each region either for its share of traffic or for the full peak (failover mode). The example below uses failover mode, which is the conservative choice and the one the self-hosted DSP infrastructure requirements article recommends for a first deployment.

Read the full bidder capacity planner: qps, instances, cost calculator guide for context, sources and limitations.

Two things stand out. Compute for 100,000 QPS costs less than a junior engineer, which is why the staffing line in the TCO methodology matters more than the cloud line. And the egress line is dominated by how many requests you answer with a bid, not by request volume, because inbound is free and no-bids are near-empty; a bidder that bids on 50% of requests instead of 20% pays roughly double for egress.

Read the full bidder capacity planner: qps, instances, cost calculator guide for context, sources and limitations.

The only public, dated load test of an open-source auction server at scale is AWS's guidance for Prebid Server on Fargate. The figures are HTTP transactions per second against the auction endpoint, where one transaction can carry several impressions, so they are not directly comparable to exchange-to-bidder QPS, but they show the shape of the curve.

Source: AWS, Guidance for Deploying a Prebid Server on AWS, accessed 17 October 2026. The test spawned 10,000 users across four US regions; 80% of requests were auction calls; average payloads were 123 KB per request and 331 KB per response. Note that response time only reaches a bidder-grade figure (under 100 ms) at 400 tasks, which is the point of the planner's utilization input. For running Prebid Server yourself, see the Prebid Server self-hosting guide.

Read the full bidder capacity planner: qps, instances, cost calculator guide for context, sources and limitations.

Is Prebid Server free? The software is free under the Apache-2.0 license for both implementations (prebid-server README; prebid-server-java README). Running it is not: Prebid.org says it "is not a turn-key solution" and that the host must build its own data pipeline for accounts and stored requests (Prebid Server hosting). The worksheet above prices the infrastructure.

Should I choose Prebid Server Go or Java? Prebid.org says to pick the language your team prefers if the features and adapters you need exist in both (PBS-Go versions page). The feature index lists 16 Java-only features and 4 Go-only ones; US state privacy (USGen module), the circuit breaker and per-account stored requests are Java-only, while geo-fencing and legacy schain locations are Go-only (feature index). Microsoft runs its commercial service on Go (Microsoft Learn, 21 October 2025).

How much does it cost to run Prebid Server on AWS? It depends on request rate, regions and egress, none of which Prebid.org benchmarks. The sourced unit prices are $0.145 per hour for a c7g.xlarge and $0.082 per hour for an m7g.large on demand, $0.0225 per hour plus $0.008 per LCU-hour for an Application Load Balancer, and $0.1752 per node-hour for a cache.r7g.large in AWS's own example (Vantage; AWS ELB pricing; AWS ElastiCache pricing).

How many bidders does Prebid Server support? Prebid.org's overview says "230+" server-side adapters; the bidder list page carries 394 entries, some of which are aliases or duplicates (Prebid Server overview; bidder list). Each adapter declares its endpoint, GVL ID, media types and user-sync method in a bidder-info file (adding a new bidder, Go).

Do I need Prebid Server to get AdX bids after the Google ruling? Not necessarily, but it is one of the two court-ordered paths. Google must build an API so Prebid can solicit real-time AdX bids and a DFP-to-Prebid-Server link (Google's estimate 12 to 15 months from the Effective Date), and separately must send AdX bids to rival ad servers (6 or 12 months, disputed) (Memorandum Opinion, Dkt. 1858, p. 58; PPC Land, 6 October 2026). A Prebid Server you host, or one a managed host runs for you, is where the first path lands; open-web display only.

• 7 Architecture Mistakes That Slow Down Ad Tech Systems: Advertising architecture problems often appear as slow bids, inconsistent budgets, incomplete reports or rising operating costs.
• Dynamic Creative Optimization: 7 Strategies That Work: Dynamic creative optimization selects a message, offer or layout from the information available for an impression.
• Enterprise Ad Tech Stack: Components, Integration and ROI: An enterprise ad tech stack combines buying, selling, data management, creative delivery, verification and measurement.
• How to Integrate DSP, SSP and DMP in One Stack: Integrating a DSP, SSP and DMP requires shared definitions for identity, inventory, campaign state, consent and reporting.
• RTB Latency Budget: QPS, Sizing and Measurement: RTB Latency Budget: a practical guide to the definitions, operating decisions, measurement and evidence you need.
• RTB Architecture Explained: DSP, SSP, Exchange, Bidstream: RTB Architecture Explained: a practical guide to the definitions, operating decisions, measurement and evidence you need.
• DSP Infrastructure Requirements and Sizing Guide 2026: DSP Infrastructure Requirements and Sizing Guide 2026: a practical guide to the definitions, operating decisions, measurement and evidence you need.

• DSP vs SSP: The Difference Explained With Examples: DSP vs SSP: a practical guide to the definitions, operating decisions, measurement and evidence you need.

• Bidder Capacity Planner: QPS, Instances, Cost Calculator: Size an RTB bidder from peak QPS, timeout, p99 target and CPU per request: instances per region, headroom, compute and egress cost with dated cloud prices.

1. PBS-Go versions page, accessed 17 October 2026
2. Prebid Server hosting
3. Prebid Server cookie sync
4. Prebid Server overview
5. same
6. Prebid bidder list
7. Prebid.org, adding a new bidder, Go, accessed 17 October 2026
8. config-app.md, accessed 17 October 2026
9. Prebid Server adapter docs
10. Prebid Server privacy
11. Prebid Server floors, accessed 17 October 2026
12. AWS Clean Rooms pricing
13. Snowflake docs
14. Microsoft Learn
15. AWS What's New, 10 April 2024
16. AWS doc history
17. InfoWorld, 28 March 2024
18. Databricks, 9 June 2025
19. IAB Tech Lab, ADMaP v1.0, accessed 17 October 2026
20. InteractiveAdvertisingBureau/ADMAP on GitHub
21. IAB Tech Lab, 10 April 2025
22. ExchangeWire, 27 May 2026
23. IAB Tech Lab, OpenRTB 2.6
24. AWS, Guidance for Deploying a Prebid Server on AWS, accessed 17 October 2026

• October 18, 2026: aligned the search title and heading, expanded the source-linked guide and reviewed its page groups.
• October 17, 2026: assembled this guide from the approved reference pages, retaining their source links and limitations.