Security & data protection

1. Scope and architecture

Flitt is made of four components. Each one has a precise role and only sees the data it needs.

Backend (api.flitt.me)

Fastify (Node.js) API behind an nginx reverse proxy, PostgreSQL database, Redis for cache, job queues and short-lived state (2FA, link codes). Hosted by Qoriz Hosting, Paris (see imprint).

Frontend (flitt.me)

Next.js. The browser never talks to the API directly: calls go through Next server routes that carry the session (httpOnly cookie) and forward to the backend as a Bearer token.

Edge SDK (self-hosted, Go)

A binary you run on your own machine to store logs and player history locally. The backend then only keeps aggregates; raw data stays with you, encrypted.

Addons (Lua GMod / FiveM, Java Minecraft plugin)

Open source and readable below. They only send game events (joins, chat, stats) to the backend or your Edge, and run the commands you trigger from the dashboard, the API or the bot.

2. Encryption in transit

TLS everywhere

flitt.me and api.flitt.me are served over HTTPS only (TLS 1.2+). HSTS is enabled in production (1 year, includeSubDomains, preload): a browser that has visited once refuses any unencrypted connection.

Security headers

Content-Security-Policy, X-Frame-Options, Referrer-Policy and X-Content-Type-Options are set by the backend (helmet). API responses are marked noindex.

Session cookies

httpOnly, Secure, SameSite=Lax. Page JavaScript cannot read the token; cross-site requests do not send it. An additional CSRF check applies to cookie-authenticated mutations.

Real time

Live dashboard updates go through secure WebSocket (wss://), authenticated with the same token and scoped per server: a client only receives events for servers it can access.

Game server → Flitt

Addons call api.flitt.me over HTTPS with the server key in the X-API-Key header (never in the URL, so never in proxy logs).

Edge SDK ↔ backend

The Edge reaches the backend over HTTPS with certificate verification (tls_verify: true by default). The backend only contacts the Edge on the public address you declare; private, loopback and cloud-metadata addresses are rejected. The Edge can serve HTTPS itself (tls_cert / tls_key) or sit behind a TLS reverse proxy.

Outgoing webhooks

Every webhook Flitt sends is signed HMAC-SHA256 (timestamp + nonce + body) so you can verify the origin and reject replays. Private destinations are refused (SSRF protection).

3. Encryption and hashing at rest

No secret is stored in clear. Depending on the need (verify vs. reuse), it is hashed or encrypted.

Passwords

Flitt stores none: authentication goes through Discord (OAuth2) or Google (OIDC). We never receive your password.

2FA secrets (TOTP)

Encrypted AES-256-GCM with a dedicated key (MFA_ENCRYPTION_KEY), separate from the session signing key.

Refresh tokens

Only the SHA-256 digest is kept. A database leak does not allow replaying a session.

Public API keys

bcrypt hashed (cost 10) + peppered HMAC-SHA256 fingerprint for lookup. The key is shown once, at creation.

Server API keys (addons)

Peppered HMAC-SHA256 fingerprint, never the raw value. Regenerable at any time from the dashboard.

Edge tokens

HMAC-SHA256 fingerprint for verification; an AES-256-GCM encrypted copy only so the backend can call your Edge. Constant-time comparison.

Edge SDK — your data

Every document (log, player, stat) is encrypted AES-256-GCM before being written, whatever the driver (file, MySQL/MariaDB, PostgreSQL). Per-document keys are derived with HKDF-SHA256 from a master key generated locally (./data/.edge_encryption_key, mode 0600) or provided by you. Flitt does not hold that key.

Edge SDK updates

Each binary is Ed25519-signed and shipped with a SHA-256 checksum. The Edge verifies both before replacing the executable; an unsigned update is rejected.

Uploaded images (banners, logos)

Re-encoded server side (sharp): EXIF metadata and any active content are stripped.

4. Token and access management

Sessions

15-minute JWT access token, 30-day refresh token rotated on every use and revoked on logout. Sessions are invalidated when the account is deleted.

Two-factor authentication

TOTP (Google Authenticator, Authy…). The MFA session allows 5 attempts then is invalidated; account deletion requires a 2FA code when enabled.

Rate limiting

Login, refresh, 2FA, Edge registration, Discord linking and the public API are limited per IP address (resolved reliably behind the proxy) and, for the public API, per key and per plan.

Server roles

OWNER, ADMIN, EDITOR. Actions that change the game server state (RCON console, bans, kicks, rank changes) require ADMIN or OWNER, whether the order comes from the dashboard, the public API or the Discord bot.

Audit log

Every remote command (RCON, ban, kick, set_group) is written to the server Audit log with its author, source (dashboard, API, bot) and content.

Edge registration

Single-use 72-bit registration code valid 48 h. The Edge token can be rotated on every heartbeat.

Discord bot

The bot talks to the backend with a dedicated internal token; administration features are locked to Flitt's official Discord server. Discord ↔ player linking uses a temporary code typed in game.

Production secrets

Kept out of the code, never versioned (.env excluded from the repository), separate keys per purpose (sessions, 2FA, API pepper, Edge). Session and API keys can be rotated without downtime.

5. GDPR compliance

Data controller

For your account data: Flitt's publisher (see imprint). For your server's player data, you are the controller and Flitt acts as processor, on your instructions (addon installation, module activation).

Data collected — account

Discord or Google ID, username, avatar and e-mail; billing data processed by Stripe (Flitt stores no card number).

Data collected — servers

Public server IP:port (public by nature), name, description, attendance statistics.

Data collected — players

Sent by your addon: nickname, game identifier (SteamID, FiveM licence, Minecraft UUID), chat messages if the module is enabled, and IP address for country geolocation and VPN detection (optional module). With an Edge SDK, this data is stored on your side.

Retention

Game logs: 7 days. Attendance and uptime samples: 90 days. On an Edge SDK: configurable (retention_days) and on-demand purge from the dashboard. Account: until deletion.

Your rights

Delete your account and all associated data directly from the dashboard (2FA protected). Access, rectification, portability or objection: through support, answered within 30 days. You may lodge a complaint with your supervisory authority (CNIL in France).

Hosting and transfers

Data hosted in France (Qoriz Hosting, Paris). Sub-processors: Stripe (payments), Discord and Google (authentication). No transfer outside the EU initiated by Flitt beyond these providers, covered by their standard contractual clauses.

Minimisation

Addon modules can be disabled individually (logs, chat, anti-VPN). A disabled module sends nothing.

6. Process and disclosure

Security review

Regular internal code review of the backend, frontend, Edge SDK and addons; fixes are deployed with priority and documented.

Report a vulnerability

Reach us through support or Discord with reproduction steps. We acknowledge within 48 h and do not pursue good-faith researchers.