Security
Your players' data stays yours.
Here's exactly what leaves your server, what we keep, and what we never do.
Data path
From your server to your dashboard
Your server
The agent connects out. Nothing opens on your server.
Ingest
The agent enrols once with a claim code, then signs every batch with its own key. We keep only the public half. It can send, never read.
Pseudonymise
Analytics use a keyed hash of each player ID. Player IP addresses are never sent. Agents look a joining player's country up on your server and send only the country code.
Encrypted store
Player IDs, names and notes are encrypted with a key per account, wrapped by a master key kept outside the database.
Your dashboard
Only your team, behind strong sign-in.
Player privacy
What happens to one player's data
Analytics use a keyed hash, so every player is a stable handle and retention and spend still work. The original ID is kept encrypted with your account's key so you can look players up and moderate them. It is never shown in the dashboard or API.
- Names stored encrypted, shown only if you turn them on
- No chat, messages, payment notes or passwords
- Player data deleted on request, including as the other side of a payment
Payment and punishment logs
Detailed logs, careful defaults
The log shows who paid whom, what sold and who was banned, keyed by the same pseudonymous IDs as the rest of your data. Abuse flags look at behaviour only: money moving between accounts, never IP addresses.
- Punishment reasons are categories unless you opt in to storing the text
- Stored reasons are encrypted, readable by moderators and up, and every read is audited
- Exports are for owners and admins, capped by plan, and audited
- The staff role sees counts only: no log, no names, no amounts
- Payments, shops and punishmentsOwners, admins, moderators and analystsYour team
- Stored punishment reasonsOne at a time, each read in your audit logModerator+
- CSV and JSON Lines exportEach export in your audit logAdmin+
- Payment notes and memosDropped on your server, never sentNever
- Same-IP alt detectionWe never receive IP addressesNever
Basic mode
No agent, no new ports
Basic mode reads the public query port your server already shows to server browsers. It isn't an agent connection, so nothing is installed and nothing is opened. We store the address you enter so we can query it, and verify you own the server with a token in its name or MOTD.
- Player count
- Map
- Version
- Uptime
- Response time
The same information any server browser can already see. Switch to the full agent for players, lag and store.
Local-only game APIs
Read on localhost, never exposed
Some games only offer a local API or local files. For those, the ServerStats sidecar (Linux x64 today, Windows soon) runs on the same machine, reads them locally and only connects out. It never uses RCON. Keep game API ports closed to the internet; you never forward them for us.
- Palworld REST API on 127.0.0.1
- Satisfactory dedicated-server HTTPS API on localhost
- Terraria TShock's REST API on 127.0.0.1
- Squad the server log only, no RCON
- Conan Exiles the server log and a read-only copy of the world database, no RCON
- SCUM the server's own log files only, no RCON
- DayZ the server's admin log
- Project Zomboid a local file written by the ServerStats server mod
- TF2, CS:Source, Left 4 Dead 2 a local file written by the ServerStats SourceMod plugin
On Roblox, a ModuleScript in ServerScriptService batches events and sends them out with HttpService. Your experience key is stored as a Roblox Secret restricted to serverstats.cc, so no script can send it anywhere else, and each server makes its own signing key in memory. Players are sent as per-experience pseudonyms, never UserIds, and nothing connects in to your experience.
Discord bot · coming soon
Only the permissions it needs
The planned bot will let you pick its channels. Discord webhook alerts work today without installing a bot.
- Planned: read member counts only, never messages
- Planned: /link will store a keyed hash of the Discord ID next to the player's hash
- Planned: removing the bot will remove its Discord data
- View and send in chosen channelsFor alerts, reports and slash commandsRequired
- Embed linksSo reports show as cardsRequired
- Manage the status channel nameOnly for the live player counterOptional
- Message contentNever requestedNever
- AdministratorNever requestedNever
Accounts
Strong sign-in by default
- Two-factor sign-inAuthenticator apps or passkeys, on every plan including Free. Owners can require two-factor for every member, with a grace period of up to 30 days.
- Argon2id passwordsNever stored in plain text.
- New-device alertsAvailable at launch: an email when a new browser signs in.
- Session listSign out any device remotely.
Your data
What we never do
- Sell or share your data
- Store player IP addresses
- Use IP addresses to find alt accounts
- Read chat or Discord messages
- Open ports on your server
- Look at your data except to fix a problem you've reported
- Use your data in benchmarks under 20 servers per group
Delete everything on any plan: deleting your account destroys its encryption key, and encrypted backups that still hold it expire within 5 weeks. You can export your data first, from Settings.
Moderation
Off until you turn it on, server by server
Kick, ban, warn and message from the dashboard only on servers where you switch moderation on, and where the game allows it. Every action is signed by ServerStats and checked by your agent before it runs, and it lands in your audit log.
- Moderators and up can act; console commands are owners and admins only
- Ingest never holds the signing key
- Time-boxed support access grants: coming soon
Report a flaw
Found a security issue?
Email [email protected]. We read every report, and we won't take action against good-faith research.
Start with one server, free
Outbound-only agent. Five-minute install.