Skip to content
PokerEnginePro
Safety

Safety first.
For players and operators alike.

Limits the player sets, registers checked before every real-money seat, a deck they can verify. For the operator, a second person for what matters, money watched for laundering, and an audit trail that cannot be rewritten. Every safeguard is tested — and broken on purpose, to prove the test catches it.
Request a demoSee the evidence

6,298

automated tests

test definitions counted from the source on 25 October 2026: engine, platform, back office, adapters, web apps, clients and browser end to end

503

rule-pack scenario tests

60 for Great Britain, 33 for Malta, 28 for New Jersey — run against the signed packs

13

self-exclusion registers integrated

seven national registers and six US state lists, plus the operator's own

1,820

safeguards broken on purpose

across the real-money work, each to prove a test catches it

For players · Responsible gambling

Limits they set.
Enforced at every seat.

Deposit, loss and wager limits and a session length, cool-off, self-exclusion and reality checks — each at the market's own settings, enforced at the gateway and again at the table.
  • Limits the player sets. Deposit, loss and wager limits per day, week and month, and a session length — counted from the ledger in rolling windows; a lowered limit applies at once.
  • A raise has to wait. A raised or removed limit waits for the market's delay — 24 hours in Great Britain, 72 in the US states — and then for the player to confirm it, lapsing if they have not within seven days.

Lowering a limit

  1. The player lowers it

    Deposit, loss, wager or session

  2. Applies at once

    On the next deposit or seat

Raising a limit

  1. The player asks

    Or removes the limit

  2. It waits

    24 h in Great Britain · 72 h in the US states

  3. The player confirms

    Nothing changes until they do

  4. Applies

The delay is the market's, from its rule pack. Losses and wagers are counted from the ledger in rolling windows.
  • Reality checks. At the market's interval — every 60 minutes in Great Britain — the player sees the time played and the net result, and takes no new seat until they acknowledge it.
  • Limits chosen before real money. Where the market requires it, the player chooses their limits before the first real-money play — and "no limit" has to be chosen too.
  • Cool-off and self-exclusion. Breaks and self-exclusion within the market's durations; a self-exclusion also goes on the operator's own list, matched by account, email, name and date of birth, so a second account is caught.
  • Help in the player's language. The market's help services are offered in the player's own language, beside their limits and breaks and in every self-exclusion, cool-off and reality-check message.
  • Checked twice. At the gateway for every real-money seat, waitlist and entry, and again inside the table and the tournament for every seat, rebuy and add-on.

Reality check

You have been playing for 60 minutes.

Time played
1 h 00 min
Net result
−£18.50

No new seat until you acknowledge this.

I understand
An illustration: Great Britain, every 60 minutes of real-money play.

For players · Age, identity and location

Old enough, who they say,
and where it is legal.

Every real-money player is old enough for their market, verified to the tier the market asks for, and inside a place where the game is allowed — checked again while they play.

Age

The market's minimum age.

18, 19 or 21 as the market sets it, checked against the date of birth the identity vendor verified — and in Great Britain before any play, play money included.

  • 18

    8 markets

    • Great Britain
    • Malta
    • Denmark
    • Sweden
    • Curaçao
    • Lagos, Nigeria
    • Kenya
    • Ghana

  • 19

    1 market

    • Ontario

  • 21

    7 markets

    • New Jersey
    • Pennsylvania
    • Michigan
    • Nevada
    • West Virginia
    • Connecticut
    • Delaware

Identity

Verification in tiers.

Tier 0 unverified, 1 identity verified, 2 enhanced due diligence, 3 high limits — the market's pack sets the tier needed to play, deposit and withdraw.

  • Enhanced due diligence when it matters. A PEP or partial sanctions match, a high-risk country — FATF's everywhere, the EU's and the UK's where they apply — or a money threshold — £5,000 in 30 days in Great Britain — sends the player to enhanced checks.
  • No document images held. Document images stay with the identity vendor and no national id is stored; a US social security number's last four go to the database check and are dropped.
  • A fake never verifies anyone. In production, a tier verified by a development vendor counts as unverified until a real vendor verifies the player.
  1. Tier 0: UnverifiedSigned in, not yet verified — the market's pack says what such a player may do.
  2. Tier 1: Identity verifiedName, date of birth and residence confirmed by the identity vendor.
  3. Tier 2: Enhanced due diligenceSource of funds — when a PEP, a high-risk country or a money threshold calls for it.
  4. Tier 3: High limitsThe top tier, where the market has one; the US states stop at tier 2.

Location

Geolocation and geofencing.

The player's location checked at connect, on an IP change and every 20 or 30 minutes as the market requires — with certified device geolocation where a regulator asks for it.

  • VPNs refused where the market says so. VPNs, proxies and Tor detected, and refused where the market's pack requires it — as in Great Britain.
  • A failed re-check sits the player out. Device checks are asked again two minutes before they expire; a failed re-check sits the player out after the hand in play, and every check is stored.
  • Real money by allow-list only. A real-money pack is never the default: an unassigned country gets play money, and a prohibited market refuses even play money.

Every market and its rules

Checked again every

30min

  • Great Britain
  • Malta

Checked again every

20min

  • US states
  • Ontario

Their data

Encrypted, kept as long as the law says,
and erased when it can be.

Personal data encrypted per value

Identity, exclusion-list subjects, message recipients, location addresses and payment tokens are each encrypted with AES‑256‑GCM and searched through blind indexes — and production will not start without the operator's keys unless an override is set, logged and shown in red.

Kept as long as the market says

Each record type kept for its market's years — five for core records in Great Britain — by the longest period among the markets the player actually played in, and KYC identity anonymised five years after an account closes.

Erasure on request

After a 30-day grace period the player's data is erased except what a regulator requires, with a record of what is kept and until when.

Player data on request

One player's whole record, across every tier, exported in one audited step.

For players · A fair deal

Every real-money deck, committed.
Checked in the player's own browser.

After any hand, play money included, the player checks the cards they saw against the commitment in their own browser, with Web Crypto — no need to trust the server.

  1. 01

    Seed

    48 bytes from the operating system's CSPRNG, fresh for every hand.

  2. 02

    Shuffle

    An HMAC-SHA256 counter stream, rejection sampling and Fisher–Yates.

  3. 03

    Commit

    A salted commitment to every card, published before the first is dealt.

  4. 04

    Open

    After the hand, an opening for each card the player saw.

  5. 05

    Verify

    Verify this hand checks every opening against the commitment, in the player's browser.

What it proves

The cards a player saw were fixed before the hand began, and dealt in their order. That the seed itself is random is what the test laboratory certifies.

The specification's test vector

commitment 7a8de53da4a20636421d0150156fe888d8b504f21f1082e18e42440a145984e4

Real-money tables, people only

No bots and no live spectators at a real-money table — a real-money tournament is watched only on a delay — and an interrupted hand is voided with every chip refunded.

An RNG log for the laboratory

Every shuffle's output, recorded for the test laboratory when switched on — kept 180 days by default and exported as JSON Lines.

Play money and real money never meet

Real money, free play chips and purchased play chips live on one ledger as different currencies, so a play chip can never become a real one.

For operators · Control

A second person for what matters.
A record no one can rewrite.

Each of these changes waits for a second approver, and whoever raised it can never approve it. Approval is kept for real money, for loosening a protection and for steps that cannot be undone.
  • Withdrawals above the threshold
  • Vendor configuration
  • Rule-pack review and market assignment
  • Money, compliance, RG and staff settings
  • Staff-role changes
  • KYC overrides
  • Clearing a screening match
  • Removal from the exclusion list
  • Lifting an AML restriction
  • Loosening a player's limits
  • Ending a break early
  • Ledger adjustments
  • Dead-letter actions
  • Stake changes at real-money tables
  • Reinstating a closed account
  • Cancelling a tournament

86

staff permissions

with every module installed, over eleven roles (ten built-in and Agent), regrouped per operator

Roles and permissions

Ops, Finance, Risk, Compliance, Support, Marketing, Auditor, the MLRO, SuperAdmin and a least-privilege LoadTest — ten built-in roles — and the Agent role with the affiliates module, eleven in all — over fine-grained permissions, renamed and regrouped per operator.

Even SuperAdmin cannot see hole cards

Only Risk can, only for settled hands, and every look is audited.

The audit trail

An audit log that cannot be rewritten.

Each operator's audit log is hash-chained — SHA‑256 of the previous hash and the entry — verified daily and on demand, and append-only in PostgreSQL.

Every command and every sensitive read — refusals included — with who, their roles, before, after, reason and address.

  1. entry 1041

    payments.withdrawal.approve

    h1041 = SHA‑256(h1040 ‖ entry)

  2. entry 1042

    screening.clear

    h1042 = SHA‑256(h1041 ‖ entry)

  3. entry 1043

    rg.release

    h1043 = SHA‑256(h1042 ‖ entry)

  • Verified every day
  • Verified on demand — it says where a chain breaks
  • Append-only in PostgreSQL
An illustration. Change, remove or insert one entry and every hash after it stops matching.

01

Signed rule packs

Packs signed with ES256 over a canonical form; production trusts only the licensor's keys and refuses an unsigned, tampered or invalid pack — and real money also needs a reviewed one.

02

No vendor fakes in production

Every vendor family has a development fake, and production refuses to use one: an unconfigured vendor answers "not configured", never a guess.

03

Jurisdiction rule packs

Each market's rules as a signed rule pack — Great Britain, Malta, Curaçao, the US online-poker states, Ontario and more — configuration, not code, reviewed by the licensee's counsel before real money.

The rule pack for every market Every vendor the platform integrates with

For operators · Clean money

Know who is paying.
Watch where the money goes.

Identity verified in tiers, money watched by the platform's own monitoring rules, and every player screened against sanctions and PEP lists — through at least two vendors for identity and for screening.

Sanctions and PEPs

Sanctions and PEP screening.

Screened at registration, on verification, on monitoring updates and when the last result is stale; a suspected match stops deposits and play until reviewed, and the player is never told of a list.

Clearing a match as a false positive, or lifting a restriction, needs a second approver.

Anti-money laundering

AML monitoring rules.

The platform's own rules, always running, beside any vendor: the market's thresholds, cumulative deposits and withdrawals, net losses, deposits withdrawn unplayed, rapid in-and-out, unusual stakes and chip dumping — with Sumsub transaction monitoring in the same queue where an operator chooses it.

  1. 01

    Alert

    One per rule, player and period, with its evidence: the money, the counterparty, the hands.

  2. 02

    Case

    Notes that link to hands, ledger entries and alerts. Every step audited; the player is never told.

  3. 03

    Decision

    • No action — Closed with the reason recorded.
    • Restrict — Suspended at once; lifted only by a second approver.
    • Report — A draft in the UK NCA SAR or Malta FIAU STR format.

Fail closed

Real money fails closed.

A geolocation outage, a failed screening or a register that cannot be asked stops real money — and only real money: play money keeps going.

When a check cannot be made

  • Geolocation outage
  • Failed screening
  • Register cannot be asked

Real money

Stops.

Until the check can be made — never treated as a pass.

Play money

Keeps going.

An outage never closes the free tables.

Payouts

Payouts, by the book.

  • Payouts back where they came from. Withdrawals are closed loop — back to the method the player deposited with — and wait in a hold account while they are reviewed.
  • Large payouts, two people. A withdrawal above €2,000, £1,750, $2,200 or C$3,000 needs a second approver, and is paid only if it is unchanged.
  • Card data never touches the platform. Cards, e-wallets and pay-by-bank through the processors' hosted fields and pages only.
  • Player funds, accounted apart. A segregated player-funds statement and settlement reconciliation against each processor.
  • Chargebacks restrict at once. A chargeback that leaves a negative balance restricts real money at once and opens a case for Finance — play money keeps working; repayments settle it, and a write-off needs a second approver.

Integrity

A fair table,
for everyone at it.

Soft play, team play, multi-accounting, bot and real-time-assistance signals, worked as cases in one integrity queue.

01

Chip dumping

One player losing to the same other player hand after hand — 500 or more over at least three hands in 30 days, nine-tenths of it one way — raised as an alert with the hands attached.

02

Soft play

Hand histories analysed for players who go easy on each other.

03

Team play

Hand histories analysed for players working together against the rest of the table.

04

Multi-accounting

One person behind several accounts, linked through shared devices, IP addresses, payment instruments, wallets and verified addresses — each kept only as a keyed hash.

05

Bot and real-time-assistance signals

Timing and decision patterns that point to a bot or to help during play — steady, fast or complexity-blind timing, marathon sessions — flagged for review.

06

The integrity case queue

Alerts with their evidence, cases with notes, real money restricted at once, and closure or confiscation only with a second person — worked like AML's, with the thresholds as Compliance settings.

Proven, not promised

Every safeguard tested.
Then broken on purpose.

Every new safeguard is broken on purpose, one at a time, to prove a test fails when it should. A check that no test notices is not a check.

1,820

safeguards broken on purpose

across the real-money work, each to prove a test catches it

105

broken in the rule packs

every one caught

99

broken in payments

every one caught

Test definitions, by suite6,298 in all · counted from the source, 25 October 2026
  • platform2,254
  • shared and mobile client code1,052
  • web apps844
  • vendor adapters567
  • game engine371
  • back office315
  • licensor console283
  • browser end to end150
  • tools, contracts and this site462

Vendor contract tests, against recorded fixtures

  • 103

    messaging

  • 80

    adapter framework

  • 60

    geolocation

  • 38

    identity (KYC)

503 rule-pack scenario tests: 60 for Great Britain, 33 for Malta, 28 for New Jersey — run against the signed packs.

Certification

Built for GLI‑19 certification.

The licence stays with the operator; the evidence comes with the platform.

  • Built for GLI-19 certification. The certification kit is ready: a GLI‑19 traceability matrix, game rules for 14 variants, an RNG sample harness, the build manifest, the critical-files list, change control and a test plan for the laboratory.
  • Change control for certification. Every regulated change classified major or minor in a change record with its evidence and lab-submission fields.

Ask how a player is protected.
We will show you the test.

A walkthrough of the safeguards with your compliance team — the limits, the registers, the approvals and the audit trail, with the evidence behind each.

Request a demoEvery market's rules