Security

• servers in Germany, no data with cloud providers
• encryption of all connections and all credentials
• strict separation of each server's data
• permissions are checked live at Discord on every request
• every action is logged, including access by our team
• a clear way to report security vulnerabilities

Modhelm runs on its own server in a data centre in Frankfurt am Main, Germany. The database and file storage cannot be reached from the internet, and administration tools only after login. We access the server only with SSH keys, not with passwords.

• All connections use HTTPS with current TLS and HSTS.
• We store Roblox API keys, bot tokens, OAuth access tokens and client secrets encrypted with AES-256-GCM. The key for this is kept separate from the database.
• We store sessions and API tokens only as a SHA-256 hash, and IP addresses only as an HMAC hash.
• We never show a stored API key in full again, only its last four characters.

• Login only through Discord with OAuth, PKCE and single-use check values that are bound to your browser. We do not store passwords.
• Each session only works on the address where you logged in. A copied cookie does not work on another address.
• Who may manage a server in the dashboard is checked live against the permissions at Discord on every request.
• Our own team needs a second factor for the staff panel (passkey or authenticator app) and is logged out after one hour without use, at the latest after 12 hours. We give rights in the team through roles and only as far as they are needed.
• The app locks after 15 minutes without use and can be unlocked again with a passkey, for example with Face ID or your fingerprint.
• Our team sees a server's data only with the booked moderation service or during a read-only support access with a reason that ends after 60 minutes. Every such access appears in the server's log.

Every query is restricted to the server it belongs to. Row Level Security is also active in the database, so public roles have no access. Files are stored separately per server. Evidence is delivered only to authorised users or through signed links that expire after a short time.

We check the type of every uploaded file by its content, not just by its name, and limit the size. We convert videos into a safe standard format on our own server and delete the original. Files are delivered with restrictive security headers so that they cannot run code in the browser.

Evidence of reports about child safety is sealed: it never appears in Discord or in direct messages, only admins and roles chosen by the team can open it, and every opening is logged.

We store ticket transcripts compressed on our own server, separated by server. Only authorised roles or whoever has a secret link can open them. We store only a hash of this link, and it becomes invalid with every new transcript. We copy attachments only from Discord's servers and check their type by their content.

We receive and send emails through our own mail server with a DKIM signature. In the staff panel we show them without scripts and without images loaded automatically. We do not accept programs and other dangerous file types as attachments. Roles control who may read which mailbox.

• We back up the database and evidence files regularly and delete backups after 30 days at the latest.
• All components are checked every minute. status.modhelm.com shows the current state.
• Jobs for Discord and Roblox run through a queue with retries.
• Bans are stored at Roblox and stay effective even if Modhelm is ever unreachable.
• An automatic deletion job removes all data whose retention period has ended, every day.

If an incident happens despite all measures, we limit the damage immediately, inform affected customers without undue delay, within 24 hours where possible, report it to the data protection authority within 72 hours where required, and inform Discord and Roblox if their data is affected.

Have you found a vulnerability? Write to us at info@modhelm.com with the subject "Security". Please describe what you found, how to reproduce it, which address or feature is affected and what impact you see.

• We confirm receipt within three working days and keep you updated.
• We fix confirmed vulnerabilities as quickly as possible and are happy to credit you if you wish.
• If you follow the rules below, we will not take legal action against you.

Rules: only test with your own accounts and your own servers. Do not access or change other people's data, except to the smallest extent needed to demonstrate the vulnerability. No denial of service, no spam, no social engineering and no physical attacks. Only publish details once the vulnerability is fixed or 90 days have passed. We do not currently run a bounty programme.

• Give Roblox API keys only the permissions they need and restrict them to your games.
• Renew keys and tokens when someone leaves your team or you suspect misuse.
• Assign admin and moderator roles sparingly and remove them when they are no longer needed.
• Set up a passkey in the app so that it stays locked if someone else gets hold of your phone.
• Give ticket rights only to roles that really need to see transcripts.
• Check your server's log from time to time and tell us about anything unusual.