Security & compliance

How passwords are stored

On the website: there aren't any

golly.gg has no password field and no email sign-up. You sign in through Steam (OpenID). Steam checks your password on its own site and tells us only your public Steam ID. We then confirm that answer directly with Steam's servers before trusting it, and each sign-in reply can only be used once, so it can't be replayed.

Once you're signed in, your browser holds a random 256-bit session token in a cookie that scripts can't read (HttpOnly, Secure, locked to golly.gg). Our database stores only a hash of that token, never the token itself, so even a copy of our database couldn't be used to sign in as you. Signing out deletes the session immediately; unused sessions expire after 30 days and are cleaned up automatically.

Kingdom Come game accounts

On our Kingdom Come server you create an in-game account with a password. That password is never stored as you typed it. It's run through PBKDF2-SHA256 - a standard password-hashing method - with a random salt unique to your account and 20,000 rounds, and only the result is kept. When you log in, the server hashes what you type the same way and compares the two in constant time. A hash can't be turned back into your password, so nobody can look your password up - not even our staff. The password itself is never written to a log.

If you change it on our website, it's hashed the moment it reaches us. Only that hash travels to the game server, and it's wiped from both systems as soon as the game confirms the change. Repeated failed logins in game get you disconnected, and password changes on the website are rate-limited.

One honest note: the Kingdom Come multiplayer mod's own game connection isn't encrypted the way a website is. As with any game server, use a password you don't use anywhere else.

Staff accounts

Staff tools need three things: a Steam sign-in, a staff role that only the server owner can grant, and a passkey (a phishing-resistant security key or device, with the private key never leaving it - we store only the public half). This second factor is mandatory, sensitive actions ask for it again, and anyone without a staff role simply sees a "page not found". Our game panel and server consoles sit behind a separate login wall with two-factor authentication, and the servers themselves accept only cryptographic keys - never passwords.

Keys for bots and game servers

Game servers and approved bots talk to golly.gg with long random keys. Like sessions, these are stored only as hashes, are limited to exactly what each one needs, and can be revoked instantly.

How the website is protected

• HTTPS everywhere. Browsers are told to only ever use HTTPS for golly.gg and its subdomains (HSTS, one year).
• Strict content rules. Each page carries a Content Security Policy that only runs scripts we've signed for that one page view, blocks other sites from framing ours, and stops forms posting anywhere else.
• No open doors. Our web servers aren't reachable from the internet directly: traffic arrives through an encrypted Cloudflare tunnel, which also absorbs attacks.
• Forged-request protection. Every action that changes something checks that it really came from golly.gg, and our APIs are rate-limited.
• No trackers. No advertising, no outside analytics, no third-party scripts. Even Steam avatars are served from our own server, so your browser doesn't contact anyone else while you browse. We count visits ourselves without cookies, using an anonymous code that changes daily, and never store IP addresses (details in our privacy policy).

Servers and backups

• Where: our servers are rented from OVHcloud in data centres in France and the UK. Your data stays in the UK and EU.
• Hardening: cryptographic-key-only logins (no passwords, no root login), automatic blocking of repeated login attempts, a deny-by-default firewall, and automatic security updates.
• Backups: every game server is backed up automatically to three different servers, and our website and panel databases are backed up every 6 hours with AES-256 encryption. Each backup is checked after it's made, and copies are deleted after 14 days, so we don't hoard old data.
• Accountability: every staff action on the website - coin adjustments, refunds, role changes - is recorded in an audit log that the website itself can't edit or delete.

Your data and your rights

We follow the UK GDPR and the EU GDPR. In practice that means collecting as little as possible:

• From Steam: your Steam ID, public name and avatar. No email address, no real name, no payment details.
• From our game servers: your in-game name, game stats, and server logs used for moderation.
• Your coin history and invites, if you use those features.

We don't sell or share your data, and we use one essential cookie only when you sign in (see cookies). You can ask to see, correct or delete your data at any time by opening a ticket on our Discord; we'll answer within a month. If you're unhappy with how we've handled your data, you can complain to the UK's Information Commissioner's Office (ICO). Full details are in our privacy policy.

Payments

golly.gg doesn't take real-money payments. Coins are earned by playing, have no cash value and can't be bought or sold. If that ever changes, payments would be handled by a dedicated payment provider, and we would never see or store card details.

Standards and certification

To be straightforward: golly.gg is not certified to ISO/IEC 27001 or any other standard. Formal certification means paid external audits, which aren't realistic for a community our size, and we won't claim a badge we don't hold.

What we do is build on recognised guidance:

• ISO/IEC 27001 principles: limited access on a need-to-know basis, two-factor authentication for staff, encryption, tested backups, logging and regular updates.
• OWASP recommendations for web applications: hashed credentials, strict security headers, forged-request protection and rate limiting.
• Data protection by design under the UK GDPR: we only collect what a feature actually needs.

Cloudflare, which carries all of our website traffic, is independently certified to ISO/IEC 27001 and audited for SOC 2.

Found a security problem?

Please tell us privately rather than posting it publicly: open a ticket on our Discord and mark it as security. We'll look at it quickly, keep you updated, and credit you if you'd like.