Security by design

How we protect your center and your players

This page describes how the platform works today: the protections built into our server, the PC client and the receiver on your network.

Decisions on our server

Billing and access are decided in the cloud. The PC client and the receiver on your network only carry out signed instructions.

Details

Account protection

Strong sign-in for owners and staff, with full control over sessions and devices.

Details

Encryption and payments

Traffic is encrypted in transit, and sensitive secrets are encrypted at rest.

Details

Data minimization

We collect what is needed to run your center, and nothing about what players browse online.

Details

Player controls

Players can recover their accounts safely and choose which messages they receive.

Details

Retention and automatic cleanup

Cleanup jobs run automatically on our server and remove operational data on this schedule.

Details

Decisions on our server

Billing and access are decided in the cloud. The PC client and the receiver on your network only carry out signed instructions.

  • Prices, session time, balances and subscription limits are calculated on our server, not on the gaming PC.
  • Every reply that unlocks a PC or runs a command is signed with HMAC-SHA256 using that PC's own secret and a fresh one-time value from the client. The client rejects any reply with a wrong signature.
  • When requests pass through the receiver on your local network, the PC doesn't send its session token. It sends a proof tied to its MAC address and a single-use nonce, and a repeated nonce is refused.
  • The device secret is stored on the PC encrypted with Windows DPAPI.
  • The client's install folder is read-and-run only for player accounts, and device secrets are accessible only to Administrators and SYSTEM.
  • The receiver's local services accept connections from private network addresses only.

Account protection

Strong sign-in for owners and staff, with full control over sessions and devices.

  • Passwords are stored as bcrypt hashes, never in plain text.
  • Two-step verification for owners and cashiers: an authenticator app (TOTP), 10 single-use backup codes stored as hashes, and passkeys.
  • Owners can require two-step verification for the owner account or for all staff, and allow trusted devices for 30 days.
  • See every active session and trusted device, sign out one or all of them, and review your center's security log.
  • Wrong sign-in attempts are limited per account and per IP address, and repeated wrong codes lock the account for 15 minutes.
  • Behind Cloudflare we use the visitor's real IP address and ignore forwarding headers a visitor could forge, so limits can't be bypassed with fake addresses.
  • Our administration panel enforces two-step verification for the main administrator, asks for re-confirmation before sensitive actions, ends idle sessions and records every change in an append-only audit log.

Encryption and payments

Traffic is encrypted in transit, and sensitive secrets are encrypted at rest.

  • All connections use HTTPS, and browsers are told to always use HTTPS (HSTS).
  • Payment gateway keys, two-step verification secrets and stored game-account passwords are encrypted in the database with Fernet (AES with HMAC).
  • Game-account passwords are never shown in the panel. They are sent only to a PC with an active session, encrypted again with a key derived from that PC's secret and that specific lease.
  • Players pay online on the payment gateway's own page. Card numbers never pass through or get stored on our servers.
  • Web push notifications are encrypted so the push service can't read them, and carry only a title, a short text and a link inside the app.
  • Digital receipts open through a random, unguessable link, not a sequential number.

Data minimization

We collect what is needed to run your center, and nothing about what players browse online.

  • From gaming PCs: device name, MAC address, hardware components and their serial numbers (to detect swapped or removed parts), status, temperature and resource use, and the games and apps started from the client.
  • Internet monitoring counts downloaded and uploaded bytes only: no websites, addresses or browsing history.
  • A live screen view of a PC is captured only when staff request it from the panel.
  • Player data is what the center enters or the player provides: name, username, phone or email, balance, sessions and purchases.
  • Each center's data is kept separate from other centers, staff see only what their role allows, and we never sell data.

Player controls

Players can recover their accounts safely and choose which messages they receive.

  • Players can reset their password themselves through a verified email, Telegram, a passkey or a one-time code from the cashier, who checks them in person. Codes are short-lived and work only once.
  • The reset form answers the same way whether an account exists or not, so nobody can use it to discover accounts.
  • After a password change, every other device is signed out and push subscriptions are removed.
  • Promotional push notifications need the player's explicit consent (off by default) and are capped per day for each center.
  • Players can turn off offers in the app at any time; after that they receive no campaign messages on any channel.
  • To request an export or deletion of data, contact us.

Retention and automatic cleanup

Cleanup jobs run automatically on our server and remove operational data on this schedule.

DataKept for
Chat messages between staff and PCs7 days
Completed device commands7 days
Files deleted from the media library7 days after deletion
Temporary customer-import files24 hours
Web push delivery queue14 days
Owner notification queue30 days
Resolved device health alerts30 days
Hourly internet usage per PC90 days, then daily totals for 2 years
Hardware change history1 year
Expired sign-in sessions1 day after expiry

Common questions

What does the client report about players?

Hardware, status, the games and apps started from the client, and internet byte counts. It doesn't collect websites, browsing history or personal files.

Can someone on the local network unlock a PC without paying?

Unlock and command replies are signed with a secret unique to each PC plus a one-time value. The client rejects a forged or replayed reply.

Do you store card numbers?

No. Online payments are completed on the gateway's own page; we record only the amount, the method and the transaction reference.

Who can see my center's data?

You and the staff you add, within the permissions you give them. Data is kept separate between centers and is never sold.

How do I get data exported or deleted?

Contact us on Discord, Telegram or through the contact page, and we'll handle the request.

Report a security issue

Found a vulnerability? Tell us privately through our support channels and we'll investigate and fix it.

  • Describe the issue and the steps to reproduce it.
  • Don't access, change or delete other people's data, and don't disrupt the service.
  • Give us reasonable time to fix it before sharing details publicly.
Report on Discord Report on Telegram All contact options

This page describes the protections built into ArenaOS today. It is not a certification or a contractual guarantee; the Privacy Policy and Terms of Use contain the legal details. Privacy policy · Terms of service

×