How we protect your account
What is in place today, what you can do yourself, and what is not in place yet. If something here stops being true, this page changes first.
What is in place
Your password is never stored
Only a salted scrypt hash is kept, which cannot be turned back into your password. Nobody at Oddflow can read it or tell you what it is.
Two-step verification
Turn it on and signing in also needs a 6-digit code from an authenticator app. A used code is never accepted twice, and ten one-time recovery codes cover a lost phone. Withdrawals ask for a code as well. Staff accounts cannot use the console without it.
Sign-ins you can see and end
Your Security page lists every device that is signed in, with a one-click sign-out, and your recent sign-ins, including failed ones. Changing your password signs out every other device.
Guessing is slowed to a crawl
Five wrong passwords lock that account for fifteen minutes, every sign-in route is rate limited, and a code challenge allows five tries in five minutes.
Safe cookies
Your session is a random token kept in a cookie that scripts on the page cannot read, that is not sent from other sites, and that travels only over HTTPS. We keep only a fingerprint of it.
Browser protections
A strict content security policy lets only our own scripts run, the site cannot be placed inside another site’s frame, and browsers are told to stay on HTTPS.
Your money is written down and cannot be edited
Every change to a balance is a line in a ledger. The database refuses to change or delete a line once it is written, a balance cannot go below zero, and a bet sent twice by a retry or a double click is placed once.
Sensitive details are encrypted
Withdrawal destinations, casino seeds and two-step secrets are encrypted before they are stored. Internet addresses are kept only as keyed hashes, used to spot two sign-ups from one place. We also keep the country your network reports when you join, to choose your currency.
Casino rounds you can check
Casino rounds follow a published scheme you can check: we show a fingerprint of our secret seed before you play and reveal the seed when you start a new seed pair, and your own browser re-plays the rounds that used it (the latest 50 are loaded) to confirm nothing was changed.
You set the limits
You choose your daily betting limit when you join. Lowering it is instant, raising it waits 24 hours, and you can take a break whenever you like.
What you can do
- Use a password you use nowhere else. Three or four unrelated words work well.
- Turn on two-step verification, and keep your recovery codes somewhere other than your phone.
- Sign out on shared or public computers.
- We will never ask for your password or a code by email, text or phone. Anyone who does is not us.
What is not in place yet
- No independent security audit or penetration test has been done yet, and no testing laboratory has certified the random number code or the game maths. Until then, treat this page as what we have built, not as a certificate.
- A new-device email alert is sent only where the operator has connected an email service, and we never send a text. Your Security page lists your devices either way.
- Identity checks before a withdrawal are done by our staff by hand. An automatic check through a verification provider exists only where the operator has connected one.
Found a weakness? Tell us before anyone else, using the contact address in the privacy notice, and give us time to fix it.