We're honest about security.
Including what we're still building.
Nothing is "100% unhackable" — anyone who tells you otherwise is lying. What we promise: defense-in-depth that makes compromise expensive, blast radius small, and recovery fast. Below is the full picture — what's live, what's in progress, what's on the roadmap. No marketing fluff.
The threat model
What attackers go after — and how we defend
Every defense decision starts with naming the threat. Here's the full attack surface for game hosts and what we do about each one.
Defense in depth
Five layers of defense
No single control is enough. Real security means breaking the kill chain at every step. Here's every control we run, with honest status flags.
Network
BGP-routed scrubbing with redundant providers. Auto-mitigation under 30 seconds.
Even our Indie tier is protected against most volumetric attacks.
OWASP-rule baseline + game-specific rules (auth abuse, IAP fraud patterns).
Customer traffic never traverses the public internet.
Mandatory for Growth+. Optional for Enterprise customers per policy.
Application
No plaintext fallback. Certificate pinning available.
Internal services authenticate via mutual TLS — no shared bearer tokens.
Per-key, per-endpoint, per-tenant. Burst tolerance configurable.
Auto-PR with patched version + smoke tests. Critical CVEs deployed within 24h.
In-toto attestation, SLSA Level 3 target. Q3 2026.
Inline detection of SQL injection, RCE attempts, prototype pollution.
Data
Source code, player data, backups, logs — everything encrypted on disk.
No data crosses any wire unencrypted.
Encryption keys live in FIPS 140-2 Level 3 hardware security modules.
Available at Scale+. Required at Enterprise. You hold the keys; we hold the ciphertext.
Hourly (Growth+) / 15-minute (Scale+) with cross-region replication.
Ransomware-proof — historical snapshots cannot be deleted within retention window.
Pattern-detection on customer support channels and shared workspaces. Q3 2026.
Identity & Access
TOTP + WebAuthn (hardware keys) supported.
No GameForge engineer reaches production without a YubiKey + dual approval.
No implicit trust. Every internal call authenticated and authorized.
Engineers request short-lived prod sessions per task. Auto-expires. Auto-audited.
SAML 2.0, OIDC. Auto-deprovision on HR systems update.
Tooling rollout. Manual today, automated via Teleport in Q3.
Operational
On-call rotation with engineering. Notification within 15 min of detection.
Engaging NCC Group for first engagement Q4 2026. Annual cadence after.
Launching on HackerOne in Q3 2026. Severity-based payouts ($100 → $25K).
Currently bi-annual. Moving to quarterly cadence in Q3.
Engaging Arctic Wolf or Expel for tier-1 monitoring. Q4 2026.
CrowdStrike Falcon on every production host. Real-time threat blocking.
Quarterly mandatory training for all employees. Annual phishing simulation.
Compliance & certifications
Where we are on every framework
We don't claim certifications we don't have. Here's the honest status of every framework you might need — and our timeline for the ones still in progress.
Responsible disclosure
Found a vulnerability?
We pay researchers for finding security issues — and we'll publicly credit you (with permission) for confirmed reports.
Email security@gameforge.ai with details, reproduction steps, and your PGP public key (if you have one). PGP key fingerprint published on this page Q3 2026.
We acknowledge within 24 hours. Triage within 72 hours. Fix critical issues within 7 days, high within 30 days.
Public program launching on HackerOne in Q3 2026. Severity-tiered payouts:
- · Critical (RCE, auth bypass, mass data leak): $5K – $25K
- · High (privilege escalation, IDOR): $1K – $5K
- · Medium (XSS, CSRF, info disclosure): $250 – $1K
- · Low (config issues, hardening): $100 – $250
Our commitments
What you can hold us to
Notify within 72 hours
If we detect a security incident affecting your data, you hear from us within 72 hours — under the GDPR maximum, regardless of jurisdiction.
You always own your data
Self-serve export at any time, in any tier. Daily JSON dumps available. Migrate off GameForge whenever you want — no lock-in.
Source code is yours
Every game we build for you ships with full source. We claim no rights to your code, assets, or game data.
No security through obscurity
This page is the contract. We document defenses publicly so you can verify, dispute, and hold us accountable.
Honest incident postmortems
When something goes wrong, we publish a postmortem within 14 days of resolution. Root cause, timeline, what we're changing.
Zero-claim policy on AI training
Your code, telemetry, and player data never train external AI models. The Federated Bug Brain uses anonymized signatures only — and you can opt out.
Need a security review for procurement?
Enterprise customers get full SOC 2 reports, pen test summaries, DPAs, security questionnaires (SIG, CAIQ), and a security architect assigned to your account. Start with a quote and we'll loop in security from day one.