Security
The best security story is not holding sensitive data in the first place. Heartbeat is designed so the worst possible day exposes gameplay counters, not people.
What we hold
- About players: numeric platform ids and gameplay events. No names, emails, chat, or device fingerprints, anywhere in the pipeline. A leak of the entire events store would expose that player 76561198... played 23 minutes and bought a supporter pack.
- About you: your email, a password hash, and your games' configuration.
How it is handled
- All traffic is TLS. The .dev domain enforces HTTPS at the browser level.
- Game keys are scoped per game and revocable from the dashboard instantly.
- Deletion is real: purging a game removes its rows permanently, not behind a soft flag.
- The code that runs inside your game is open source and auditable before you ship it.
- No ad networks, no data resale, no cross-game profiles. Ever.
Reporting a vulnerability
Found something? Email hello@gameheartbeat.dev with "Security" in the subject. We read these first, respond fast, and credit reporters who want credit. Please do not test against accounts that are not yours.
What we do not have yet
No SOC 2 or ISO certification, we are a beta, and we will not pretend otherwise with a badge wall. When a certification is real, it will be listed here.