Security for regulated books
Keys stored as hashes, signed webhooks, production access tied to a licence record and no personal data needed from your customers.
Hashed API keys
Keys are shown once and stored only as SHA-256 hashes. Revoke any key instantly in the console.
Signed webhooks
HMAC SHA-256 over the timestamp and raw body, with your own secret per endpoint and replay protection by timestamp.
Licence before production
Production keys need a licence record with licence number, regulator and jurisdiction.
No personal data required
Risk and settlement work on your own customer references. You never send names or emails.
Encrypted in transit
Every endpoint is served over HTTPS only. Webhook endpoints must be https.
Enterprise paperwork
Data processing agreement, security documentation, invoices, SSO with SAML, roles, audit log and IP allow-list.
Security questions
How are API keys stored?
As SHA-256 hashes. A key is shown once when you create it and can be revoked at any time in the console.
How do we verify webhooks?
Each request carries X-RTB-Signature with a timestamp and an HMAC SHA-256 signature of the timestamp and raw body, made with your endpoint secret.
Do you need our customers' personal data?
No. Risk checks and bets use your own customer reference. Send an internal id, not a name or an email address.
What does Enterprise add?
SSO with SAML, roles, an audit log, IP allow-listing, a data processing agreement, security documentation and a 99.95% uptime SLA.