Subprocessors
The entities that may process data in connection with providing the service. The list is complete as far as known on 5 August 2026.
- Discord Inc. — The platform the bot runs on. The source of every identifier and every piece of content handed to the bot. Location: The United States. A transfer outside the EEA on the terms Discord sets (standard contractual clauses / the EU–US Data Privacy Framework adequacy decision).
- The VPS provider — The application server and the SQLite database the bot and the panel run on. The bot's and the panel's data never leaves that server — we do not replicate it to other providers.
- FACEIT — Only where a user voluntarily links their account — to fetch the player's statistics. Location: The European Union / the United Kingdom. An optional integration; without a linked account no data is exchanged.
The data is neither sold nor shared for marketing purposes. We do no advertising profiling.
Encryption and safeguards
- Transport encryption — Traffic to the panel and the API goes over HTTPS only; the production CSP carries the `upgrade-insecure-requests` header.
- A Content Security Policy with a nonce — Every request gets its own random nonce and the policy uses `strict-dynamic`. A script injected by an attacker holds no valid nonce, so it never runs. This protection costs us the ability to cache the public pages — we chose the protection.
- The public layer and the panel are separate — The landing page loads no session context, so an anonymous visit never asks the API about an identity. The panel sits behind Discord OAuth2 and a check of permissions on the specific server.
- Boundaries between servers — A permission on one server grants no read access to another. Access to the MSIoU network requires reciprocity, and a policy error narrows the scope rather than widening it.
- Accountability for actions — Actions in the panel go into the change log, and dossier lookups into the lookup register along with the identity of the person asking.
No system is fully immune to threats. In the event of a personal data breach we act under Articles 33 and 34 GDPR: a notification to the supervisory authority within 72 hours and a notification to the people concerned where the breach carries a high risk.
Reporting vulnerabilities
We accept reports at security@venon-sec.xyz. We run no cash bounty programme — so we promise nothing we do not deliver. We do answer reports and let you know when a fix ships.
- Report it to the security address — Please send descriptions of vulnerabilities to security@venon-sec.xyz. Useful: the steps to reproduce, the impact and the version you observed it on.
- Do not publish before the fix — Please hold off on disclosure until a fix ships. In return we confirm that we received the report and keep you posted on the progress.
- Do not test on other people's data — Research should stay on servers where the reporter holds permissions. We are not asking anyone to obtain other people's data to demonstrate a vulnerability — a description of the mechanism is enough.
- No attacks on availability — Load tests, volumetric tests and API spam are not covered by this invitation.
Requesting data deletion
The fastest route is a request to the server administrator — they decide about their members' data and have the tool for it in the panel. If the server administrator cannot be reached, or the request goes unanswered, please write to privacy@venon-sec.xyz.
Removing the bot from a server starts the deletion cycle described above. It requires no further request — 90 days after the bot leaves, nothing that could be attributed to that server remains.
Opting out of the MSIoU network (an objection to cross-server processing) narrows the dossier to the server where the question was asked. It does not remove the cases run by the administrator of the server the person is actually on — those belong to that administrator.