Security

This guide covers security features available to site administrators: two-factor authentication for admin accounts, fraud detection, anti-money laundering (AML) reviews, and account security controls.

Admin Two-Factor Authentication (2FA)

Admin accounts can use TOTP-based 2FA with any standards-compliant authenticator app (Google Authenticator, Authy, 1Password, etc.). When Settings > Features > Two-Factor Auth is enabled, admin login requires 2FA and admins without 2FA configured are prompted to set it up during login.

Enabling 2FA

Setup happens on the login screen when you are prompted:

The system generates a TOTP secret and displays a QR code.
Scan the QR code with your authenticator app.
Enter the 6-digit code shown in your app to confirm setup.
Save the backup codes that appear — these are shown only once. Store them securely (password manager or printed copy). Each backup code can be used once if you lose access to your authenticator app.

The 2FA setup is a two-step confirmation: the QR code/secret is generated first, and 2FA only activates after you enter a valid code.

Logging In with 2FA

When the Two-Factor Auth feature toggle is enabled, after entering your username and password, you are prompted for a 6-digit TOTP code or a backup code. Codes are time-based and expire every 30 seconds.

Backup Codes

Each backup code works once, in place of a TOTP code at login. To check the remaining count or generate a new set, use the admin 2FA API under /api/v1/admin/2fa. Generating a new set immediately invalidates all previous codes.

Disabling 2FA

Another admin can remove your 2FA with Reset 2FA on your user record. See Account Security Controls.

Auth Config (Per-Role Rate Limits)

Required permission: settings:edit to read. Updating or resetting also requires a super admin.

Super admins can configure per-role authentication thresholds via the auth-config API endpoints. There is no page for this in the admin sidebar. This allows different admin roles to have different login attempt limits, lockout durations, session lengths, and token expiry times.

Setting	Description	Default (a/a1)	Default (b)
`maxLoginAttempts`	Failed attempts before lockout	10	7
`lockoutDurationMinutes`	Lockout duration after exceeding attempts	5	10
`sessionDurationHours`	Admin session lifetime	12	8
`accessTokenExpiryMinutes`	Access token TTL	60	30

Endpoints:

GET /api/v1/admin/auth-config — List all role configs
GET /api/v1/admin/auth-config/:level — Get config for a specific role
PUT /api/v1/admin/auth-config/:level — Update config (super admin only)
DELETE /api/v1/admin/auth-config/:level — Reset to defaults (super admin only)

Roles without a custom configuration use built-in defaults. Deleting a config row resets the role to its defaults.

Fraud Alerts

Required feature toggle: fraudAlerts must be enabled in Settings > Features.

Required permission: compliance:view to list/view, compliance:edit to update.

Fraud alerts are automatically generated by the fraud detection system when suspicious patterns are detected. Navigate to Compliance > Fraud Alerts.

Alert Types

Type	Description
`COLLUSION`	Multiple accounts suspected of coordinating play
`MULTI_ACCOUNT`	Same player operating multiple accounts
`CHIP_DUMPING`	Deliberate chip transfer to another player
`BOT`	Suspected automated play

Alert Severity

Level	Meaning
`LOW`	Suspicious pattern, low confidence
`MEDIUM`	Moderate confidence of violation
`HIGH`	Strong indicators of violation
`CRITICAL`	Multiple high-confidence indicators or urgent real-money risk

Fraud Cases

Required feature toggle: fraudAlerts must be enabled in Settings > Features.

Required permission: compliance:view to list/view, compliance:edit to update, run sweeps, and manage detector rollout.

Fraud cases group related fraud alerts into an operator review workflow. Navigate to Compliance > Fraud Cases.

Endpoints:

GET /api/v1/admin/fraud-cases — List cases by status, severity, or assignee
GET /api/v1/admin/fraud-cases/:id — View case details, evidence, and member alerts
PATCH /api/v1/admin/fraud-cases/:id — Assign, resolve, or disposition a case
POST /api/v1/admin/fraud-cases/:id/reopen — Reopen a resolved case
GET /api/v1/admin/fraud-cases/:id/replay-fixture — Export sanitized suspect-hand replay fixture
GET /api/v1/admin/fraud-cases/detector-configs — List runnable detector configs
POST /api/v1/admin/fraud-cases/detector-configs — Create a new detector config in shadow mode
POST /api/v1/admin/fraud-cases/detector-configs/:detectorName/:version/promote — Promote a shadow config
POST /api/v1/admin/fraud-cases/detector-configs/:detectorName/rollback — Roll back to the previous active config
POST /api/v1/admin/fraud-cases/sweep — Run feature extraction and detector sweep

New v2 detectors start in SHADOW and write ShadowDetection rows only. Active detectors create alerts and cases.

Reviewing an Alert

Open the alert to see the evidence panel, which lists supporting data points.
Click View Related to see linked accounts and other alerts involving the same users.
Assign the alert to yourself or another admin using the Assign dropdown.

Updating Alert Status

Status	Meaning
`OPEN`	New, unreviewed
`INVESTIGATING`	Under active review
`RESOLVED`	Investigation complete

Set a Resolution note when closing an alert to record the outcome. The resolution field accepts up to 2,000 characters.

Filtering Alerts

Use the filter bar to narrow results by:

Status (OPEN / INVESTIGATING / RESOLVED)
Type (COLLUSION / MULTI_ACCOUNT / CHIP_DUMPING / BOT)
Severity (LOW / MEDIUM / HIGH / CRITICAL)
User ID
Assigned admin
Date range
Sort order (by creation date, severity, status, or type)

AML Reviews

Required feature toggle: amlReviews must be enabled in Settings > Features.

Required permission: compliance:view to list/view, compliance:edit to approve or reject.

AML (Anti-Money Laundering) reviews are triggered automatically when transactions exceed configured thresholds or match suspicious patterns. Navigate to Compliance > AML Reviews.

Review Statuses

PENDING — Waiting for admin review. The associated transaction is on hold.
APPROVED — Transaction cleared to proceed.
REJECTED — Transaction blocked.

Reviewing a Transaction

Open a pending review to see the full transaction details, user information, and any associated sanctions check result (provider, match score, match details).
Add review notes to document your assessment.
Click Approve to release the transaction, or Reject to block it. A rejection reason is required.

Approving or rejecting a review records the reviewing admin’s ID and timestamp for audit purposes.

Pending Reviews

The Pending tab shows only reviews awaiting action. Use this as your daily work queue. The stats panel at the top shows counts by status.

Sanctions Check Data

When a transaction is flagged, the system may have run an automated sanctions check. The review detail shows:

Provider used
Match result (hit / clear / error)
Match score (percentage confidence)
Match details (names or identifiers matched)

Chargebacks

Required feature toggle: chargebacks must be enabled in Settings > Features.

Navigate to Compliance > Chargebacks to view and manage payment chargebacks filed by players or their payment providers. Open a chargeback to see its linked transaction and Status History, update its status with notes, and upload evidence files.

Affiliate Fraud

Required feature toggle: affiliates must be enabled in Settings > Features.

Navigate to Compliance > Affiliate Fraud to review suspected fraudulent affiliate activity. Open a flag to see its Evidence Details, then choose Confirm Fraud or Dismiss, with optional notes.

KYC Verification

Required feature toggle: kycVerification must be enabled in Settings > Features.

Navigate to Compliance > KYC Verification to review identity verification documents submitted by players.

Admins with compliance:view permission can view submitted documents. The document viewer supports images and PDFs. Approve or reject verification with optional notes.

Sanctions Checks

Required feature toggle: kycVerification must be enabled in Settings > Features.

Navigate to Compliance > Sanctions Checks to review sanctions screening results. Filter by result: NO_MATCH, POTENTIAL_MATCH, MATCH, or ERROR. Open a check to see the provider, match score, and match details, or click Re-check to run a new check for that user.

Account Security Controls

Open a user from Users to reach these account-level actions:

Action	Effect
Block	Prevents login and gameplay
Unblock	Restores access
Reset 2FA	Removes the user’s two-factor setup
Force Disconnect	Ends the user’s active connection

To freeze an account during a fraud investigation, use POST /api/v1/admin/users/:userId/freeze. See Common Workflows.

These actions are logged in the audit trail and can trigger system emails if those event types are configured (see System Emails).

Audit Logging

Admin actions are recorded in Settings > Logs under the Admin Actions tab, with the admin, action, resource, and result. See Logs. Partner API activity has its own log under Developer API > Audit Log.

For game-level audit trails, see Game History.

Settings — Features Tab — enable/disable fraudAlerts, amlReviews, kycVerification, chargebacks
Users — block, unblock, and manage individual accounts
Game History — per-hand audit trails