Security practices
This page lists what we actually do, in plain language. We don't hold a security certification yet (see the last section), so we'd rather describe real practices than claim a badge we haven't earned.
Last reviewed on 22 October 2026.
Encryption
Every page and API on our platform is served over HTTPS; there is no unencrypted fallback. Passwords are never stored in plain text, only as a one-way, salted hash. Our own platform backups (see below) are encrypted before they ever leave the server that made them.
DDoS protection
Every service includes DDoS protection by default, at no extra cost. Attack traffic is filtered at the network edge before it reaches your server, so it doesn't consume your server's own CPU or bandwidth. No protection stops every attack; during an exceptionally large one we may temporarily limit traffic to protect our network and other customers, as described in our terms of service.
Staff access
Staff accounts use two-factor authentication and are limited to what their role needs: most actions that touch money, refunds or account security are restricted to the owner, not available to general support staff. Sensitive actions are recorded in an audit trail so we can tell what happened and who did it.
Service-to-service security
Virenix is built from several internal services (billing, provisioning, the customer portal, the staff admin). None of them trust a request just because it comes from inside our network: every internal call is authenticated with its own signed token, and the webhooks that move data between them are cryptographically signed and safe to retry, so a redelivered message can't double-charge an invoice or create a server twice.
Platform backups
We take daily encrypted backups of our own platform's databases and uploaded files (such as support ticket attachments), and we restore a copy of them on an automated schedule to verify they actually work. This protects our platform's own records, such as your invoices and account data. It is not the same as a backup of your game server: in the control panel, you create and restore your own server backups yourself, up to the number included in your plan, exactly as our terms of service describe. Keep your own copy of anything on your server that you can't afford to lose.
Reporting a vulnerability
If you find a security problem, please email us at the address on our contact page before telling anyone else. Give us a reasonable chance to investigate and fix it, and avoid accessing or changing data beyond what's needed to demonstrate the issue. We won't take legal action against a good-faith report made this way.
What we don't claim
We are not SOC 2 or ISO 27001 certified, and we have not yet commissioned an independent third-party penetration test. Both are real goals, not something a smaller, pre-revenue company can credibly claim overnight, and we'd rather say so plainly than imply a certification we don't have.