Security
How we protect the Service, and how to report a vulnerability.
How we protect the Service, and how to tell us about a security problem.
1. How we protect the Service
- License signing keys are generated and held in a hardware security module (AWS KMS) and can’t be exported. The server’s credentials allow signing only.
- Player data is hosted in the EU (Frankfurt, Germany), encrypted in transit (TLS) and at rest.
- Device fingerprints are stored only as keyed hashes of individual signals, never as raw hardware identifiers.
- Administrative access is limited to Bindseal.
- We monitor the license server’s availability every five minutes.
Our Data Processing Addendum lists the measures we commit to, and our sub-processors page lists the providers we use.
2. Reporting a vulnerability
Email security@bindseal.com with a description of the problem, the steps to reproduce it, and its impact as you understand it. We will acknowledge your report within three business days, keep you updated, and tell you when it is fixed. We are happy to credit you, if you want.
3. In scope
bindseal.com,api.bindseal.comandstatus.bindseal.com;- the Bindseal SDK and its license, signing and verification logic.
A way around the protection in one particular game is usually a matter for the studio that made it. If you think it shows a flaw in the SDK itself, tell us.
4. Rules
- Don’t access, change or delete data that isn’t yours; stop and tell us if you reach it by accident.
- Don’t run denial-of-service tests, send spam, or use social engineering or physical attacks.
- Don’t test our providers (for example Cloudflare, Fly.io, Neon, AWS or Paddle) — report to them directly.
- Give us reasonable time to fix a problem before you disclose it publicly.
If you follow these rules in good faith, we won’t pursue legal action against you for your research. We don’t run a paid bug bounty at the moment.