Security is a core part of building ilzion, our live multiplayer quiz platform. This page explains, in plain language, the practices we use to protect accounts, quiz play, and the data described in our Privacy Policy. We have written it to be truthful rather than impressive: we describe measures we genuinely have in place, and we are equally clear about the things no online service can promise.
1. Our approach
ilzion is built around two ideas: defense in depth and a server-authoritative design.
- Defense in depth means we do not rely on any single control. We combine transport encryption, hashed credentials, server-side authorization, database-level access rules, input validation, and rate limiting so that a weakness in one layer is not, on its own, enough to compromise an account or the platform.
- Server-authoritative design means the parts that matter for fairness and integrity are decided on our server, not trusted from whatever a browser sends us. Answer correctness, scoring, timing, and quiz state are validated server-side, so a player cannot award themselves points or change a result by tampering with their own client.
2. Measures we actually use
The following describes the controls that are genuinely in place today. We will keep this list current as the platform evolves.
2.1 Encryption in transit
All traffic between your browser and ilzion is served over HTTPS/TLS. Connections terminate at a TLS-terminating reverse proxy in front of our application, so data moving between you and us is encrypted on the wire.
2.2 Passwords and credentials
Account passwords are hashed with bcrypt and are never stored in plaintext. We cannot read your password, and we never ask you for it by email or message. If you connect a streaming platform (Twitch, YouTube, or Kick) for streamer features, the OAuth access and refresh tokens we hold are encrypted at rest using AES-256-GCM.
2.3 Authorization and database security
Access to data is enforced on the server. We use server-side authorization checks on requests together with row-level database security, so accounts can reach their own records and not other people's. Authorization is checked on the server rather than assumed from the interface a client happens to show.
2.4 Input validation and rate limiting
Incoming requests are validated before they are processed, which reduces the impact of malformed or malicious input. Sensitive endpoints — such as sign-in, account actions, and quiz joins — are protected by rate limiting to slow down abuse, credential-guessing, and automated flooding.
2.5 Server-authoritative quiz play
Quiz play integrity is enforced on our server. Submitted answers, scores, response times, and streaks are validated server-side and are not trusted from the client. This keeps quizzes fair and makes client-side tampering ineffective for changing outcomes.
2.6 Administrative audit logging
Sensitive administrative and owner actions are recorded in audit logs for security and accountability. As noted in our Privacy Policy, these security event records may include an IP address and user-agent. They are for internal administrative review only and are not public.
2.7 Backups
We keep routine encrypted backups so that data can be recovered after an incident or failure. Backups rotate on a regular schedule, which is also why deletion of an account takes effect across backups over a short period rather than instantly everywhere.
2.8 Self-hosted infrastructure
ilzion is self-hosted: the database, authentication, storage, realtime, cache, and web server run on our own dedicated server infrastructure behind a TLS-terminating reverse proxy. Self-hosting means very few external parties are involved in handling your data, which keeps the surface we have to secure smaller and more directly under our control.
3. Account security is shared
Some of the most effective protection is in your hands. You can help keep your account safe by:
- using a strong, unique password that you do not reuse on other sites;
- keeping the email address on your account secure, since it can be used to recover access;
- disconnecting any streaming-platform integration you no longer use from your account settings;
- signing out on shared or public devices; and
- contacting us promptly if you notice anything unexpected on your account.
4. Honest limitations
We want to be direct about this: no system or online service can be guaranteed 100% secure. Our goal is to reduce and manage risk, not to claim we have eliminated it. We do not describe ilzion as unhackable, breach-proof, or guaranteed secure, because no honest service can promise that.
ilzion is not certified against any formal security standard. We make no SOC 2, ISO, or PCI claims, and we do not represent that we have completed any particular third-party audit or penetration test. We describe the measures we actually use, and nothing more.
Security is also an ongoing effort rather than a finished state. Threats change, and so does our software; we expect to keep improving these practices over time. Your use of ilzion is governed by our Terms of Service, including the sections on warranties and liability.
5. Reporting a vulnerability (responsible disclosure)
If you believe you have found a security vulnerability in ilzion, we genuinely want to hear from you. Please report it to security@ilzion.com rather than disclosing it publicly, so we have a chance to investigate and fix it first.
To help us act quickly, a useful report typically includes:
- a clear description of the issue and why you believe it is a security problem;
- the steps needed to reproduce it, including any relevant URLs or requests;
- the impact you think it could have; and
- any proof-of-concept details, screenshots, or logs that help us understand it.
We ask security researchers to act in good faith. Specifically, please:
- avoid violating the privacy of others, destroying or altering data, or disrupting our service;
- do not access, download, or retain more data than is necessary to demonstrate the issue;
- use only your own accounts and test data, and stop as soon as you have confirmed a vulnerability; and
- give us a reasonable opportunity to respond and remediate before any public disclosure.
We do not currently operate a paid bug-bounty program, so we cannot promise a monetary reward. We do commit to reviewing good-faith reports and to working constructively with researchers who follow the guidance above.
6. Related policies
For how we collect and handle data, see our Privacy Policy. For the rules that govern your use of ilzion, including warranties and liability, see our Terms of Service. For general questions you can reach us via our Contact page, and for anything specifically security-related, email security@ilzion.com.