What this panel knows about your players
Before anything about how it is protected, here is what it holds. You are being asked to trust software with this, so you should see it first.
- license
- The one identifier FiveM always provides. Every player, every session.
- license2
- Their second Rockstar identifier, where the game reports one.
- steam, discord
- Only if those were running when they connected. Neither is guaranteed.
- xbl, live
- Their Xbox account, for anyone playing a Microsoft Store copy.
- hwids
- Tokens the game derives from their machine. Not a serial number, but durable enough to recognise a returning account.
- name, playtime
- The name they chose in game, and how long they have been on your server.
- screenshots
- Their game view, captured when a staff member asks for it. Never their desktop, and never anything outside the game.
That is a serious amount to hold about someone, and most of it arrives without the player doing anything except joining. The rest of this page is where it sits, what stands in front of it, what you can take back out, and the things this software deliberately does not do.
Where it lives depends on which edition you run
The difference is not a feature list. It is who holds the database, who holds the keys, and who is responsible when something needs fixing.
Self-hosted, under licence
You are the controller and the processor. We are neither.
- The data never reaches us. It is your database on your cPanel or Plesk hosting. There is no phone-home carrying player records, and no support login into your install.
- You hold both encryption keys. They live in your config.php. If you lose them, the values encrypted under them cannot be recovered by us or by anyone — that is the point of them, and it is also the risk. Back that file up separately from your database.
- Security fixes are yours to apply. Until you do, you are running the old code. This is the real trade for owning the data.
- The licence check is the one call that leaves your server. It sends your domain and version, and nothing about your players.
Hosted by us
You are the controller. We are your processor, under the DPA.
- It is our server, behind Cloudflare. The origin is not reachable directly, so traffic aimed at it hits Cloudflare rather than the machine holding your database.
- Security fixes arrive without you doing anything. That is the trade in the other direction.
- We can see your data, and you should know that. Running the hosted service means an administrator here can open, export, suspend or delete any community, because somebody has to be able to when a database goes wrong or an account is abandoned. That is what hosting means anywhere, for any product. What you should expect is to be told.
- You can leave with everything. Export from inside the panel at any time, without asking us, and delete the community yourself when you are done.
What stands in front of it
Named by what each one stops, rather than by its acronym. You run a game server; you should not have to look anything up to read this.
There is no password to steal
Sign-in is your Steam account. The panel never holds a password for you or for your staff, so there is nothing in the database for anyone to crack or reuse elsewhere.
A request that did not come from the panel is refused
Anything that changes something — a ban, a permission, a settings save — carries proof it originated in a page you had open. A link on another site cannot make your browser act on your behalf.
Your game server proves which server it is
Each server signs what it sends with its own key. Knowing your community ID is not enough to file a ban, a log line or a screenshot as you, and a signature cannot be replayed later.
The browser refuses any script the panel did not put there
Every page carries a policy naming exactly which code may run, with a value that changes on each request. Injected script does not execute even if something else went wrong first. It is the layer that is supposed to catch our own mistakes.
Screenshots are not reachable from the web
They are served only to signed-in staff, blocked from direct access, and deleted on a schedule you set — five days by default. There is a public disclosure page written for your players, because taking a picture of someone's screen deserves saying out loud.
The credentials you paste in are encrypted and never shown again
Your Discord bot token, Tebex secret and Steam API key are encrypted in the database and write-only in the interface. To be exact about the limit: player identifiers are not encrypted. They are what every ban is matched on, so they have to be readable — anyone claiming otherwise about a panel like this has not looked.
Every staff action is written down, including the deletions
The audit log records what your own staff did, not only what happened to players: every removed ban, every permission change, and where it was done from. It is only useful if you assume staff accounts can be the problem.
What comes back out, and what does not
You can export or delete your community's data at any time, from inside the panel, without asking us and without waiting on a support reply.
An erasure request from one of your players comes to you, not to us, because your community is the data controller. You carry it out from that player's page, and you choose whether the ban survives it.
It should: their profile, warnings, notes and screenshots go, and the ban record stays and keeps working. Data protection law does not require anyone to erase the records they need in order to prevent abuse, and a ban record is exactly that. So a cheater cannot launder a ban by asking to be forgotten.
Players can see their own record and appeal a ban. They cannot delete anything themselves.
What this does not do
Given the same weight as the section above it, on purpose. A page that lists only strengths is the one thing that would make the rest of it worth less.
It is not an anticheat
It does not scan memory, inspect running processes, or detect cheat software. It records who did what and helps you act on it. Anyone selling you detection built this way is selling you something else.
Hardware IDs can be spoofed
The tokens come from the player's own machine, so a spoofer defeats a hardware ban. What they catch is the far more common case: somebody who could not be bothered. And when the identifiers stop lining up, the panel shows you the signs.
A determined evader gets back in
New Rockstar account, spoofed tokens, no Steam and no Discord running, and there is very little left to recognise. Matching every identifier raises the cost. It does not make it impossible, and no panel makes it impossible.
Nothing here bans automatically
Detections are flags for a person to look at, never actions taken on their own. A false positive that bans a paying player is worse than a cheater who lasts another evening.
This is a young product
No customer logos, no third-party audit certificate, no bug bounty programme. What there is instead is everything above, stated plainly enough that you can check it yourself against the demo and the manual.
Responsible disclosure
Found a security problem? Tell us directly
Email is the right channel for this, not a support ticket — a ticket needs an account, and you should not need one to report a bug in someone else's software.
Send it to [email protected] with Security report in the subject. Please do not open a public thread about it before we have replied.
What helps
- The URL or the page, and what you did on it.
- What happened, and what you expected instead.
- Whether you needed an account, and what rank it had.
- Anything you saw that belonged to a community other than your own — that one matters most.
What we will do
- Reply to say we have it, rather than leaving you wondering.
- Tell you what we found, including if we conclude it is not a problem and why.
- Fix it, and describe the fix in the panel's own What's New so every community sees what changed.
- Credit you if you want it, and leave you out of it if you do not.
There is no bounty programme. Saying so up front is fairer than letting you find out after the work.