Security

Security isn't a feature we bolted on — it's the foundation the platform is built on.

Account protection

Passwords are hashed with PHP's password_hash() (bcrypt) and never stored or displayed in plain text. Logins are rate-limited with an automatic lockout after repeated failures. Admin accounts additionally require re-entering the account password to open the admin panel after an hour of inactivity from it.

Session handling

Sessions use httpOnly, SameSite cookies, are regenerated on every privilege change, and expire automatically after a period of inactivity.

Deposits

Crypto deposits are processed through NowPayments. Every payment notification is cryptographically verified before we credit any balance, and each payment can only ever be credited once — even if the same notification is delivered twice.

Data we don't store

We do not collect KYC documents, and we never store a full card number or CVV — only the last four digits are kept, for your receipt.

Auditability

Every administrative action — balance adjustments, account changes, withdrawal approvals — is written to an append-only audit log.

Found a security issue? Please contact us directly rather than posting it publicly.