Security

Last updated 8 September 2026

Encryption in transit

Every connection to Rostack uses TLS, terminated by Google Cloud with certificates it manages and renews. Responses carry Strict-Transport-Security with a two-year lifetime, includeSubDomains and preload, so once a browser has visited, it refuses to send anything to rostack.app over plain HTTP.

Calls from Rostack to Roblox and to Google services are likewise TLS only.

Encryption at rest

All stored data lives in Cloud Firestore, which encrypts it at rest with AES-256 as a property of the platform. Credentials get a second, independent layer: they are encrypted with Cloud KMS before being written, so a copy of the database alone yields ciphertext, and decrypting it requires a separate permission that a database read does not confer.

Rotation creates a new key version for new encryptions while older versions continue to decrypt what they encrypted, so nothing is re-encrypted in bulk and nothing becomes unreadable.

Why the website cannot read a payout credential

Roblox publishes no API for group payouts. The only way to move Robux is a Roblox account cookie, which is far more powerful than the key ranking uses: it acts as the whole account. Rostack handles that asymmetrically.

The website can therefore store a credential it is permanently unable to read back. The service that can decrypt it has no public address, accepts requests only from the website's own service identity, and has two software dependencies in total. The plaintext exists inside one request and is never logged or written anywhere.

Ranking does not use your account cookie

Ranking runs on Roblox's official OAuth for sign-in and on the Open Cloud API for changing roles, authenticated by an API key you create in Roblox's own dashboard with exactly the scopes it needs. Rostack never asks for a cookie to rank anyone.

Rostack's own API keys, the ones your game server or bot presents, are stored only as a SHA-256 hash. The plaintext is shown once at creation. A copy of the database contains nothing that can call the ranking API.

Authentication for money

Using payouts at all requires a verified email address and an authenticator app enrolled on the account. The two operations that actually move money, connecting a payout credential and releasing a run, each ask for a fresh code at that moment.

Codes are checked at the moment of the action rather than at sign-in, because a session lasts fourteen days and "they used a second factor a fortnight ago" is a much weaker statement than "they are holding the phone now". Each code works once: the matched time step is recorded and anything at or before it is refused, so a code observed over someone's shoulder cannot release a second payout inside its thirty-second window.

Removing the authenticator also requires a current code, so a hijacked session cannot strip the second factor and then move money.

Authorization

Two authorities apply to every action and they are not the same thing. Your Roblox rank is the ceiling: a Rostack seat can hold less authority than its group rank allows, never more. Rostack permissions are the grant within that ceiling. A compromised Rostack account is therefore strictly less dangerous than the Roblox account behind it, and demoting someone in Roblox demotes them here.

Because Roblox sends no notifications when ranks change, actions that change state re-read the live rank from Roblox before acting. Nobody can edit their own access, grant a permission they do not hold, or act on a seat at or above their own rank.

The audit log

Every privileged action is written to the log before the action runs, with the actor, the reason and a trace ID, then updated with the outcome. A crash mid-action still leaves evidence that it was attempted. The log is append-only in Firestore's security rules, so no client, including ours, can edit or delete an entry through the application.

Browser-side protections

Pages are served with a Content Security Policy that forbids inline scripts unless they carry a per-response nonce, forbids framing entirely, restricts form submission to Rostack's own origin, and limits network requests to Rostack and the Google authentication endpoints. Sessions are an httpOnly, Secure, SameSite=Lax cookie that JavaScript cannot read.

Your data

From Settings you can download everything Rostack holds about you as a JSON file, or delete your account. Both are immediate and self-service. Deleting your account ends every session, removes your sign-in, authenticator, seats and warnings, and revokes pending invitations. What is retained afterwards, and why, is listed on the privacy page and shown to you before you confirm.

What is not claimed

Rostack has not undergone a SOC 2 or ISO 27001 audit and has not commissioned an independent penetration test. This page will say so until that changes. If you find a vulnerability, please report it privately to security@rostack.app rather than publicly.