Security
Security measures, stated plainly
What the software does today, and what we have not yet done. Procurement teams get the same answers we give ourselves.
Authentication
- API keys are stored only as SHA-256 hashes and shown once
- Scoped keys (ingest, tokens, read, admin), named, revocable instantly, last use recorded
- Key rotation invalidates the old key immediately
- A key used outside its scope receives 403
- Console staff sign in with a password and an authenticator-app code; accounts lock after repeated failures
- Admin and read-only analyst roles
Player tokens
- HMAC-SHA256 signed, per-casino secret, compared in constant time
- Short-lived (15 minutes by default, one hour at most)
- Never contain the operator API key
- In the iframe they travel in the URL fragment, not sent to servers or logs
Abuse protection
- Rate limits per IP before authentication, then per verified caller
- Unverified credentials never get their own bucket
- Bounded memory for limiter state
- Errors never expose internals; each carries a request ID
Webhooks
- https only in production
- Private, loopback, link-local and other internal addresses are refused, with the DNS answer checked and pinned
- Redirects are never followed
- Signed with a timestamp so receivers can reject replays
Data isolation
- Each casino's data is isolated; a key or token for one cannot read another's
- Ingest is serialised per casino, so concurrent feeds cannot lose or double-count rounds
- Tested with forged and expired tokens
Web hardening
- Security headers: nosniff, no-referrer, HSTS in production
- Content security policy on the console
- The embed can be framed only by the casino's own sites
- Output escaping, URL allow-listing and CSV formula-injection protection
Secrets
- Signing secrets encrypted in the database (AES-256-GCM) with a key held outside it
- Passwords hashed with scrypt; session tokens stored as hashes
- Rotation commands for every secret
- Tokens and keys removed from logs
Audit
- Console sign-ins, configuration changes, key creation and revocation, erasures, rebuilds and purges are logged
- Every support player lookup is logged with the key used
Privacy tools
- Pseudonymous player IDs only; no names, emails or payment data
- Erasure removes every row tied to a player
- Retention deletes raw rounds after your chosen period (minimum 30 days)
- No cookies and no browser storage in the widget
Assurance
- 264 automated tests, plus a real-PostgreSQL suite
- Two independent code reviews: 65 issues found and fixed; the few design items left open are listed for procurement on request
- Dependency audit and secret scanning on every change
- Automated accessibility checks with 0 axe-core violations at A and AA
What we have not done yet
Honest status. There has been no external penetration test, and we do not hold ISO 27001 or SOC 2. A data processing agreement and a DPIA template are being prepared with counsel and are needed before go-live. Production hosting is planned in the EU. Ask us for the current status before you rely on any of these.
Report a vulnerability
Email security@slotclarity.com. We welcome good-faith research, will acknowledge your report and keep you informed. Our security.txt lists the same contact.
Try it with sample data
Create a test casino, watch the player panel update from sample rounds and paste a few of your own rounds into the data checker. No card and no personal data needed.