Security
Last updated: 2026-06-15
This page explains, in plain language, how TopPlayer.gg protects your data and your purchases: what we encrypt, who can access what, and how to report a security issue to us. We would rather describe exactly what we do than show badges, so everything below reflects how the store actually runs today.
Certifications and compliance
TopPlayer.gg does not currently hold third-party security certifications such as SOC 2 or ISO 27001, and we will not display logos for certifications we have not earned. Our data-protection practices follow GDPR principles: you can read what we collect and why in our Privacy Policy, and request erasure at any time via our Data Deletion page. Payments are completed on our payment providers' own hosted checkout pages — card and wallet details are handled entirely on their infrastructure and never touch our servers.
Read our Privacy Policy →Data encryption
All traffic between your browser and TopPlayer.gg is encrypted in transit with TLS 1.2 or 1.3, and we enforce HTTPS with HSTS (two-year policy, preload). At rest, game keys and serial codes are encrypted with AES-256-GCM before they are written to our database, each record with its own unique initialisation vector, and key values are redacted from application logs. Account passwords are stored only as one-way hashes — nobody at TopPlayer.gg can read them. When you create an account or change your password, we also screen it against known breached-password lists using a k-anonymity lookup, so your password is never sent anywhere in readable form.
Data residency
Customer data lives in our own PostgreSQL database on dedicated servers that we operate ourselves behind our own reverse proxy — not on a shared multi-tenant platform. A small number of specialised providers process specific data on our behalf, such as payment providers, our transactional email service, and — only with your consent — analytics; the full list is in our Privacy Policy. We do not sell customer data.
See who processes your data →Access controls
Access to customer data inside TopPlayer.gg is role-based and follows least privilege. Administrative functions run on a separate authentication system from customer accounts, and every administrative API endpoint re-verifies the admin role on each request. Game keys are stored encrypted and stay masked even in internal tooling unless an authorised, authenticated request needs them — for example, delivering your order. Authentication events such as sign-ins and password changes are recorded in an audit log, sensitive operations are rate-limited, and two-factor authentication (TOTP) is available on every account — we recommend enabling it in your account settings.
Reporting a vulnerability
If you believe you have found a security issue in TopPlayer.gg, please email [email protected] with "SECURITY" in the subject line and we will get it to the right person. Include enough detail for us to reproduce the issue. We ask that you give us reasonable time to fix it before any public disclosure, avoid accessing other customers' data, and avoid disrupting the service. We will not pursue legal action against good-faith security research that follows these guidelines. A machine-readable version of this policy is published at /.well-known/security.txt.
View our security.txt →Incident history
To date, TopPlayer.gg has not experienced a security incident involving unauthorised access to customer data. If that ever changes, we will notify affected customers directly and publish a summary on this page with dates and what was done to resolve it.
Security testing
Our codebase goes through continuous internal security review, including automated analysis and manual audits of the authentication, payment and order-delivery flows, and findings are triaged and fixed as part of normal development. We have not yet commissioned an independent third-party penetration test; when we do, we will publish the date of the most recent test here, and you will be able to request further details through our support contact.