Security Overview

Security is built into Gamivate from the database up. Here’s a summary of how we protect your data and your customers’.

Tenant isolation

Every brand’s data is isolated at the database layer with row-level security, enforced on every query — not just in application code. One brand can never see another’s players.

Data protection

• Encryption in transit (TLS) and at rest.
• IP addresses are hashed; we practise data minimization.
• Secrets are kept out of the codebase.

Consent & auditability

Player consent is captured explicitly and stored in an append-only audit trail: each choice is a new record, never an edit to an old one.

Game & embed isolation

Games run in sandboxed iframes from an isolated origin, so game code can never access platform cookies or data. Scores are checked server-side against each game’s declared range and accepted once per play session.

Responsible disclosure

Found a vulnerability? Please report it via our contact page and we’ll respond promptly.