How we protect your data and payments
This page is maintained by AtlasBlox and describes the controls we actually ship. It is not an independent audit or certification. If you spot a security issue, please report it — details at the bottom.
No passwords to leak
AtlasBlox uses Discord OAuth exclusively for sign-in. We never see, store, or transmit your Discord password. Sessions use short-lived tokens managed by Lovable Cloud.
Row-level security on every user table
Every table that stores your data (orders, tickets, receipts, gift codes, notification prefs) has row-level access rules enforced by the database, not the app. A bug in the frontend cannot expose another user's data — the database rejects the query before it runs.
Secrets never touch the frontend
API keys (NOWPayments, Discord bot token, TRONGrid, Etherscan, webhook signing secrets) live in Lovable Cloud secrets and are only readable inside server-side code. Public keys (the publishable Supabase key) are the only credentials shipped to the browser.
Card payments are handled by Paddle, not by us
When card, Apple Pay, or Google Pay checkout is switched on, the payment is taken by Paddle acting as merchant of record. Card details are entered in Paddle's own hosted checkout and never reach an AtlasBlox server, which keeps us in the lightest PCI DSS scope (SAQ A). Crypto payments are handled separately and are never mixed with card data. Card checkout is currently turned off while Paddle finishes reviewing the domain.
Browser and transport hardening
Every page is served with HTTPS only (HSTS), a content security policy that blocks injected scripts, framing disabled, MIME type sniffing turned off, and a referrer policy that stops your page addresses leaking to other sites.
Every webhook is signature-verified
NOWPayments IPNs are HMAC-verified with a timing-safe compare against a rotatable secret before we mark anything paid. Our own bot-to-server calls carry a signed timestamp + HMAC to prevent replay. Cron endpoints are locked to the same scheme.
Daily spend caps + alerts on paid APIs
Every call that costs money (NOWPayments invoice creation, Lovable AI) is metered against a per-provider daily cap. At 50% used we get a Discord alert; at 100% we refuse to create more invoices until midnight UTC or until an admin raises the cap.
CAPTCHA + rate limiting on public forms
The DMCA takedown form and other public intakes are protected by Cloudflare Turnstile and per-IP rate limits. Sensitive metadata (IP addresses on abuse forms) is stored as an HMAC hash — enough to detect repeat abuse, not enough to identify a specific person.
Access logging you can audit
Admin actions, role grants, payment confirmations, ticket closes, and webhook dispatches are written to append-only audit tables. Sign-in events and site visits are logged with country and browser only — never with any ability to read your other browsing.
Reporting a vulnerability
Found something? Please report it privately to security@atlasblox.com before disclosing publicly. We aim to acknowledge reports within 48 hours. Please do not run automated scanners against production — reach out first and we'll set up a safe test window.
Machine-readable contact info also lives at /.well-known/security.txt.
For data-subject requests (access, export, deletion) see our privacy request form. For the underlying legal terms see the privacy policy and terms.