Security overview

This page explains how Deltaship protects your releases and your players, in plain words.

Signed releases#

When you publish a release, Deltaship signs a short record that says which release is current for your game on that channel. Only Deltaship holds the signing key; it never leaves a separate signing service. Your launcher checks the signature, and refuses:

• a release not signed by Deltaship;
• a release for another studio, game, channel or platform;
• an older release replayed in place of a newer one (rollbacks you make are always newer, so they pass);
• a record that is more than a day old. Installed games still play; only installs and updates wait.

Your launcher design is signed the same way, so a launcher only ever shows the design you published.

Verified installs#

Every downloaded part and every finished file is checked against the signed release before it is used. A damaged or tampered download is refused and the player keeps the version they had. Files are only ever replaced by complete, checked files, and the launcher only writes inside the game's install folder.

Isolated studios#

• Everything a studio stores (builds, releases, images, players) is kept under that studio only. Storage is never shared between studios, even for identical files.
• A team member, a publish token or a player of one studio cannot see or reach anything of another studio. Asking for another studio's things gets the same answer as asking for something that does not exist.
• Players are per studio: the same email at two studios is two separate accounts.

Accounts and tokens#

• Passwords are never stored as they are typed; only a salted, slow one-way form is kept. Sign-in is rate limited and every failure gives the same message.
• Publish tokens are shown once and stored in a form Deltaship cannot read back. Revoke them at any time.
• Players' launcher sessions are short-lived and renew in the background. Disabling a player ends all their sessions at once.
• The launcher keeps the player's session encrypted with the operating system's own protection, and never gives it to the launcher's screens.

The launcher on players' computers#

• The launcher's screens cannot reach the network or the file system directly; everything goes through a small, checked set of actions.
• Links open in the player's browser only if they are your studio's links.
• The launcher starts only the game file named in your release, inside the install folder, with the arguments you set.
• The launcher installer is code-signed, and launcher updates are checked against that signature before they run. The exception is an unsigned pilot build: its installer is not code-signed, and its updates are verified against a record Deltaship signs for each version, so an update that does not match is refused.

What Deltaship can and cannot see#

Deltaship staff use studio data only for support and operations.