Every trade, ranking and payout on Market Kings depends on data you can trust. Security is not a feature we bolt on at the end; it is built into how the arena runs. This page explains how we protect the Platform, your Account and your personal data, and what we ask of you in return.
1. Our security principles
- Server-side authority. The outcome of every trade and every Event is decided on our servers, never on your device.
- Least privilege. People and systems get only the access they need, for only as long as they need it.
- Defence in depth. We layer controls so that no single failure exposes your data.
- Data minimisation. We collect only what we need and delete it when we no longer need it.
- Transparency. If something goes wrong, we will tell you.
2. Infrastructure
Market Kings runs on Vercel and Amazon Web Services (AWS) in region. These providers operate data centres certified to leading industry standards, including ISO 27001 and SOC 2, with physical security, redundant power and networking, and continuous monitoring.
- Production, staging and development environments are separated, and real user data is not used in development.
- Databases and storage are not directly exposed to the public internet.
- Network access is controlled by firewalls, security groups and private networking.
- Real-time market data and gameplay updates are delivered over encrypted connections.
3. Encryption
- In transit: all traffic between you and the Platform is encrypted using TLS 1.2 or higher, with HTTP Strict Transport Security enforced.
- At rest: databases, backups and file storage are encrypted using AES-256 or equivalent.
- Passwords: stored only as salted, one-way hashes using a modern, slow hashing algorithm (such as bcrypt). We cannot see your password.
- Secrets: API keys, credentials and encryption keys are stored in a dedicated secrets manager, never in source code, and rotated regularly.
4. Identity verification data
We carry out identity verification in-house, so we hold ourselves to a higher standard for this data.
- ID documents, selfies and liveness data are uploaded over an encrypted connection and stored encrypted, in storage isolated from gameplay and account data.
- Access is restricted to a small number of named, trained verification staff, protected by multi-factor authentication, and every access is logged.
- Biometric data is permanently destroyed within 30 days of verification completing, and ID documents are deleted at the end of the retention period in our Privacy Policy.
- Verification data is never used for marketing, never sold, and never shared with third-party verification providers.
5. Payments and payouts
- Card payments are handled by Stripe, our PCI DSS Level 1-compliant payment processor. Full card numbers never reach our servers.
- Payment webhooks are cryptographically signature-verified before we act on them, so subscription status cannot be spoofed.
- Payouts are sent only to verified accounts or wallets in the winner's name or control, through Wise, Skrill, Rise or supported crypto rails. Changes to payout details trigger re-verification.
- Payouts are reviewed before release, and high-value or unusual payouts require additional approval.
6. A tamper-proof game
- Orders are sent from your device, but prices, fills, positions and results are calculated and recorded only by our server-side trading engine.
- Every order and account change in an Event is written to an audit log with a timestamp and cannot be altered from the client.
- Every trade can be replayed against the prices that were live at the time, so disputes can be resolved with evidence.
- Automated monitoring and human review detect multi-accounting, collusion, automation and price exploitation. See How Competitions Are Monitored and our Anti-Cheat Policy.
7. Application security
- Code changes are peer-reviewed before release, and security-sensitive changes receive additional review.
- We build against the OWASP Top 10, including protections against injection, cross-site scripting, cross-site request forgery and broken access control.
- Every API request is authenticated and authorised on the server. Unique identifiers are generated securely and cannot be guessed.
- Rate limiting and bot protection defend log-in, sign-up and trading endpoints against brute-force and abuse.
- Dependencies are scanned and updated to address known vulnerabilities.
- We commission independent code audits and security testing before launch and at least annually, and remediate findings based on severity.
8. Access control and our people
- Access to production systems and personal data is granted on a least-privilege, need-to-know basis and reviewed regularly.
- All staff and contractor accounts use multi-factor authentication.
- Administrative actions are logged and monitored.
- Staff and contractors sign confidentiality agreements, receive security and data protection guidance, and lose access immediately when they leave.
9. Vendors
We assess the security and privacy practices of our service providers before engaging them, bind them by data processing agreements, and give them access only to the data they need to perform their service.
10. Monitoring, backups and resilience
- Systems are monitored continuously for availability, performance and suspicious activity, with alerts to our team.
- Data is backed up automatically, backups are encrypted, and restoration is tested periodically.
- We maintain plans to restore service after an outage. If an outage affects an Event, we will act as described in our Terms of Service and How Competitions Are Monitored.
11. Incident response
We maintain a documented incident response plan covering detection, containment, investigation, recovery and review. If a personal data breach occurs, we will notify the Information Commissioner's Office within 72 hours where required, and notify affected users without undue delay where there is a high risk to their rights and freedoms, explaining what happened and what we are doing about it.
12. Protecting your Account
Security is shared. Please:
- use a strong, unique password that you do not use anywhere else;
- turn on two-factor authentication;
- never share your login, verification codes or recovery details with anyone, including anyone claiming to be from Market Kings;
- keep your device, browser and app up to date;
- check you are on playmarketkings.com before logging in; and
- tell us immediately at admin@playmarketkings.com if you notice unusual activity.
We will never ask for your password, two-factor codes or full card number by email, message, social media or phone. Official emails come only from @playmarketkings.com addresses.
13. Report a vulnerability
We welcome reports from security researchers. If you believe you have found a vulnerability, email admin@playmarketkings.com with the subject "Security Report", including a description, steps to reproduce and potential impact.
Our commitments: we will acknowledge your report within 3 business days, keep you updated, and credit you (if you wish) once the issue is fixed.
Safe harbour: if you act in good faith and follow these rules, we will not pursue legal action against you for your research. You must:
- not access, modify or delete other users' data beyond the minimum needed to demonstrate the issue;
- not degrade or disrupt the Platform, including through denial-of-service, spam or automated scanning at volume;
- not use social engineering, phishing or physical attacks;
- not use a vulnerability to gain any advantage in an Event or obtain any Reward; and
- give us reasonable time to fix the issue before disclosing it publicly.
Exploiting a vulnerability for gain, rather than reporting it, is a breach of our Terms of Service and Anti-Cheat Policy.
14. Our limits
We work hard to protect the Platform, but no system connected to the internet can be guaranteed to be completely secure. This page describes our practices and is not a contractual warranty. Our legal commitments are set out in our Terms of Service and Privacy Policy.
15. Contact
Security questions or concerns: admin@playmarketkings.com (subject line "Security").