iGaming Platform Security Controls Comparison

Yes

Supported conclusion

Multi-factor authentication and unified back-office access control are included.

Role-based per-application access

Supported conclusion

Unified Access Control manages access to individual back-office applications and configurations.

Yes

Supported conclusion

System and user actions on player records are tracked.

Unresolved

Platform-wide at-rest encryption and key-management specification remain unresolved.

Yes

Supported conclusion

The architecture includes encrypted communications and zero-trust network segmentation.

Unresolved

Regulated hosting implies resilience controls; universal managed DDoS entitlement, provider and capacity commitment remain unresolved.

Unresolved

Managed WAF provider, policy and entitlement are contract-specific.

Unresolved

The detailed Attestation of Compliance, scoped systems and penetration-test calendar remain unavailable. EveryMatrix's actual cadence is unresolved.

No

Editorial inference

A coordinated vulnerability-disclosure policy and dedicated security-reporting channel are not established.

Yes

Verified conclusion

The ISMS includes incident reporting, investigation and escalation, while GDPR creates a processor-to-controller notification duty. Contractual deadline and severity matrix remain contract-specific.

Yes

Editorial inference

Role-Based Access Control

Editorial inference

IMS is run by around 11,000 admin users across partner companies through 600-plus back-office interfaces, so access is split by role. The exact permission granularity remains partner-gated.

Yes

Editorial inference

Yes

Editorial inference

Secure storage and current security controls are established; a product-wide encryption-at-rest specification remains unresolved.

Yes

Verified conclusion

Yes

Editorial inference

Yes

Editorial inference

Recurring proactive testing; cadence unresolved

Supported conclusion

Proactive penetration testing plus application and infrastructure scanning are established; the interval is deployment-specific.

No

Editorial inference

A coordinated vulnerability-disclosure policy is not established.

Yes

Verified conclusion

The 2025 incident-response policy requires internal reporting within 24 hours, central incident recording, containment and recovery, and notification of clients, regulators or affected individuals when thresholds are met.

Unresolved

Mandatory operator-back-office MFA across every module is not established.

Role-based, multiple permission levels

Verified conclusion

Unresolved

The back office contains game and player activity history. A dedicated admin action log remains unresolved.

Unresolved

ISO/IEC 27001 and PCI DSS scope do not establish the at-rest algorithms, key ownership or database-by-database product coverage.

Yes

Verified conclusion

Yes

Verified conclusion

Runs traffic through Cloudflare, which cut DDoS hits reaching its systems from several a week to a few a month.

Yes

Verified conclusion

Web services use Cloudflare application-security controls; product coverage remains deployment-specific.

Unresolved

ISO/IEC 27001, GLI testing and private vulnerability intake do not establish a product-specific penetration-test cadence or result.

No

Verified conclusion

The bug bounty is private and invitation-only. Open participation, safe-harbour terms and an external reporting endpoint remain unresolved.

Yes

Editorial inference

A 24/7 CSIRT supports contractual and regulatory notification workflows; exact customer-notification deadlines and severity thresholds belong in the DPA/SLA.

Unresolved

ISO certification does not establish the exact privileged-access MFA control exposed to every operator.

Role-based permissions for platform administration

Verified conclusion

Role-based access control is included; exact role matrices are deployment-specific.

Yes

Verified conclusion

The platform specification includes administration audit logs; Data Lake lineage is a separate control.

Unresolved

At-rest encryption algorithms, key custody and the exact platform and operator-hosted deployment scope remain unresolved.

Unresolved

Transport protocols and the exact platform, integration and operator-hosted endpoint scope remain unresolved.

Yes

Supported conclusion

The current AWS integration explicitly offers enterprise DDoS protection. Coverage is available through that deployment path and should not be read as proof of identical controls in every operator-hosted environment.

Unresolved

A WAF in every deployment is not established.

Unresolved

The ISO-certified management-system scope does not establish a product-specific penetration-test cadence or result.

No

Editorial inference

A live RFC 9116 security.txt provides cert@pragmatic.solutions, a PGP key, canonical URL and expiry through October 2027. A coordinated-disclosure policy, safe-harbour terms and remediation SLA are not established, so the reporting route alone is not a full VDP.

Yes

Verified conclusion

One 2023 customer agreement requires incident notice without undue delay, a detailed incident description, reasonable requested information, mitigation and remediation assistance; universal timing remains contract-specific.

Unresolved

A portfolio-wide operator MFA requirement and supported-method list remain unresolved.

Role-based; exact permission matrix unresolved

Editorial inference

The regulated enterprise PAM separates operator roles; cross-product role granularity remains unresolved.

Yes

Editorial inference

Privileged actions are auditable across regulated PAM and lottery operations; exact event coverage remains unresolved.

Unresolved

Product- and entity-specific encryption-at-rest standards remain unresolved.

Unresolved

Product- and entity-specific transport-encryption standards remain unresolved.

Unresolved

Group cyber controls do not establish a named DDoS service or customer entitlement for Interactive products.

Unresolved

The production WAF and its scope remain unresolved.

Routine at Aristocrat Group level; Interactive-specific cadence unresolved

Supported conclusion

The group program includes routine penetration testing and annual cyber audits.

No

Editorial inference

A division-wide coordinated vulnerability-disclosure policy, security.txt and dedicated security-reporting workflow are not established.

Yes

Editorial inference

Group incident and crisis-response procedures are established; customer-notification SLAs remain product- and contract-specific.

Unresolved

Access controls can include MFA, but mandatory MFA for operator back-office users is not established.

Retail hierarchy: Owner, Partner, Super Agent, Agent, Cashier, User; core PAM administrator-role matrix unresolved

Supported conclusion

Yes

Supported conclusion

Retail cashier tools include audit tracking for settlements, reprints, adjustments and voids. The retention period, tamper controls and coverage of every core PAM administrator action remain unavailable.

Yes

Supported conclusion

Sensitive information is encrypted at rest, but algorithms, key management and database-level scope remain unavailable.

Yes

Supported conclusion

SSL/TLS is applied to sensitive data transmissions.

Unresolved

The DDoS mitigation provider, control set and service level remain unresolved.

Unresolved

Firewalls are used, but a web application firewall is not established.

Regular independent penetration testing; exact cadence unresolved

Supported conclusion

No

Editorial inference

A coordinated vulnerability-disclosure policy, security.txt and dedicated security-reporting workflow are not established.

Yes

Supported conclusion

Breach procedures include notifying affected people and supervisory authorities where legally required.

Unresolved

Operator-back-office MFA remains unresolved.

Granular operational roles

Editorial inference

Trading, risk, partner, support and compliance duties require separated permissions and auditability across operator teams.

Unresolved

A product-level administrative audit-trail specification remains unresolved. Regulated operation and certification do not substitute for a feature specification.

Yes

Editorial inference

Advanced encryption is in use; algorithms, key-management ownership and system-by-system at-rest scope remain unresolved.

Yes

Editorial inference

Yes

Editorial inference

Sits behind AWS edge protection as part of its cloud stack.

Yes

Editorial inference

Unresolved

The penetration-test calendar, scoped systems and exact cadence remain unresolved. Certification requirements do not substitute for deployment-specific assurance.

No

Editorial inference

Security and privacy contacts are available; a standalone coordinated-vulnerability-disclosure policy is not established.

Unresolved

Customer-facing breach-notification process, timing and contractual trigger remain contract-specific. ISO certification alone does not answer this field.

Yes

Editorial inference

Granular role-based administration

Supported conclusion

Yes

Supported conclusion

Yes

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Regular third-party penetration tests and cyber maturity assessments

Verified conclusion

Yes

Verified conclusion

Yes — responsible reporting channel.

Yes

Verified conclusion

Yes — formal incident response and customer/regulator escalation.

Yes

Editorial inference

Yes/role-controlled for administrative access. Exact tenant policy is partner-gated.

Role-gated partner portal/back office; exact permission matrix is partner-specific

Editorial inference

Unresolved

Regulated administration and ISO change controls do not establish the exact administrator-event history, retention or export scope.

Unresolved

ISO/IEC 27001 does not establish the at-rest encryption algorithms, key custody or product and data scope.

Unresolved

Transport encryption for operator APIs and portal traffic, including protocols and endpoint scope, remains unresolved.

Unresolved

DDoS mitigation for the selected hosted deployment, including provider, capacity and covered endpoints, remains unresolved.

Unresolved

A managed web-application firewall, its rule coverage and its exact hosted-product scope remain unresolved.

Unresolved

ISO/IEC 27001 and regulated-system assurance do not establish a product-specific penetration-test cadence or result.

No

Verified conclusion

A dedicated Pariplay vulnerability-disclosure policy is not established.

Unresolved

Contractual, GDPR and licence duties apply, but the customer-notification workflow, severity matrix and deadline remain contract-specific.

Yes

Supported conclusion

Centrivo CRM security management explicitly includes 2FA authorization, role-based access, sensitive-data masking and important-actions history.

Configurable role and permission controls

Supported conclusion

DGBuilder and Centrivo Retail include permission-based access and adaptable roles; field-level granularity remains unresolved.

Yes

Supported conclusion

Centrivo CRM records important-action history; Paydrom also records access, actions and events. Retention and immutability remain unresolved.

Yes

Supported conclusion

Personal data is held in an encrypted, password-protected database. Algorithms, key management and full platform scope remain unavailable.

Yes

Supported conclusion

Unresolved

Managed hosting includes threat detection, intrusion detection and high availability, but a DDoS mitigation service, provider, capacity and covered endpoint scope remain unresolved.

Unresolved

Active firewall software and intrusion detection do not establish a dedicated managed web application firewall, its vendor or rule coverage.

Unresolved

Denmark's certification programme requires annual penetration testing for licensed game suppliers, but a completed test, product scope, cadence and result remain unresolved.

No

Editorial inference

Security.txt, safe-harbour language and a vulnerability-reporting workflow remain unavailable. This is distinct from internal PCI vulnerability management.

Unresolved

Business-sale notification is covered, but the customer security-incident notification timetable remains contract-specific.

Unresolved

Password and access controls are contractually required; operator MFA scope and enforcement policy are unresolved.

Role-based; permission depth unresolved

Editorial inference

RBAC covers support, administration, compliance and reporting responsibilities; the entitlement matrix remains unresolved.

Unresolved

Regulated case handling and end-to-end traceability provide an audit trail; admin-event detail remains unresolved.

Unresolved

At-rest encryption algorithms, key custody and the exact platform, payment and personal-data scope remain unresolved.

Yes

Verified conclusion

Sensitive personal information transmitted wirelessly or across public networks must be encrypted, with encryption keys protected.

Unresolved

The managed regulated service does not by itself establish a DDoS mitigation provider, capacity, covered endpoint scope or contract entitlement.

Unresolved

Industry-standard firewalls, antivirus and malware controls are contractually required, but web-application-firewall coverage remains unresolved.

Unresolved

Annual third-party security audits and annual SOC 2 Type II work are contractually referenced, but penetration-test cadence is not.

No

Verified conclusion

A vulnerability-disclosure policy and dedicated security contact are not established.

Yes

Verified conclusion

Actual or suspected security incidents require written notice promptly and no later than 24 hours, followed by investigation, containment, remediation cooperation and a recurrence-reduction plan.

Yes

Verified conclusion

Back-office and Aff.Tech access controls include 2FA and granular permissions.

Granular role, permission and data-masking controls

Verified conclusion

Yes

Verified conclusion

Yes

Supported conclusion

Sensitive data is encrypted at rest; exact system and key-management scope remains part of technical diligence.

Yes

Verified conclusion

The current and archived privacy policies commit to transport encryption.

Yes

Editorial inference

AWS infrastructure plus WAF and IPS/IDS support the conclusion; a dedicated DDoS product remains unresolved.

Yes

Supported conclusion

Recurring under PCI/ISO controls; exact cadence unresolved

Editorial inference

Yes

Verified conclusion

A current security.txt points to a disclosure policy, PGP key and disclosure@gr8.tech; initial response target is three business days.

Yes

Verified conclusion

Established breach procedures notify affected parties and regulators where legally required.

Yes

Editorial inference

Granular by user, brand, market, licence and operational function

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Yes

Editorial inference

Regular independent security testing; exact cadence varies by certification and market

Verified conclusion

No

Editorial inference

A coordinated vulnerability-disclosure policy is not established.

Unresolved

GDPR and regulated-market duties require incident and breach handling, but the implemented customer-notification workflow, timetable and severity matrix remain unresolved.

Unresolved

MFA coverage and enforcement across every Bragg operator back office remain unresolved; general access-control governance does not establish operator MFA.

Unresolved

A concrete role and permission model is not established. Regulated multi-team operation does not by itself establish RBAC granularity.

Yes

Verified conclusion

Yes — required for regulated operations and exportable campaign logs.

Unresolved

The ISO management-system scope does not establish at-rest encryption algorithms, key custody or product and data coverage.

Yes

Editorial inference

TLS-secured production integrations.

Unresolved

The DDoS mitigation vendor, scrubbing capacity and deployment scope remain unresolved. ISO-scoped security controls do not establish DDoS protection coverage.

Unresolved

Managed-WAF product, vendor and coverage remain unresolved for operator deployments. General firewall and information-security controls do not establish web-application firewall coverage.

Unresolved

Regulated deployments and the ISO management system do not establish a product-specific penetration-test cadence or result.

No

Editorial inference

A coordinated vulnerability-disclosure policy, security.txt and dedicated security-reporting workflow are not established.

Yes

Editorial inference

Contractual, regulatory and privacy-law notification duties apply. The 2025 incident was notified to authorities and regulators.

Unresolved

Universal back-office MFA entitlement, supported factors and enforcement policy are unresolved.

Unresolved

Multi-user operations are established; the role/permission matrix and field-level access-control specification are unresolved.

Unresolved

Transaction, KYC and status histories provide an operational record, but a searchable administrator-action log, its immutability, retention and export scope remain unresolved.

Unresolved

Platform-wide at-rest encryption and key-management design are unresolved.

Unresolved

Marketing web services use encrypted transport; platform-wide API, service-to-service and data-feed encryption standards are unresolved.

Unresolved

Secure hosting and DDoS mitigation are recommended controls, but a standard managed entitlement is not established across Slotegrator contracts.

Unresolved

The managed WAF provider, policy and standard entitlement are unresolved.

Unresolved

Penetration-testing cadence and attestation are unresolved.

No

Verified conclusion

A coordinated vulnerability-disclosure policy and dedicated security-reporting channel are not established.

Unresolved

Incident-notification timeframes, severity matrices and customer processes are unresolved.

Partial

Editorial inference

A monitored production 2FA service exists, but universal enforcement across every back-office role and deployment is unresolved.

Role and permission controls across users, projects and functions

Verified conclusion

Spring back office supports roles and permissions; Affigates adds global and individual permission controls plus hierarchy-based access. Exact field-level permissions remain unresolved.

Unresolved

Player activity, reporting and access controls are established; the scope of a searchable immutable administrator-action log remains unresolved.

Unresolved

TLS/SSL and API-integrity controls are established; the current encryption-at-rest standard, key-management design and scope remain unresolved.

Yes

Verified conclusion

Yes

Verified conclusion

Offered as a Pro DDoS Protection add-on for white label and turnkey partners, with BetConstruct handling domain management.

Yes

Verified conclusion

The optional Pro DDoS Protection service includes enhanced WAF capability, bot mitigation and managed rules for white-label and turnkey partners whose domain management is handled by BetConstruct.

Unresolved

Penetration-test cadence and outcome scope remain unresolved.

No

Editorial inference

A coordinated-vulnerability-disclosure policy and dedicated security-reporting channel are not established.

Unresolved

The incident-notification timetable and customer playbook are contract-specific; GDPR duties still apply where relevant.

Partial

Editorial inference

Partial and deployment-specific. Access controls are required, but mandatory MFA for every back-office account is not established.

Role-based access; exact permission granularity private

Editorial inference

Yes

Verified conclusion

Yes

Editorial inference

Algorithms and key-management scope remain unresolved.

Yes

Verified conclusion

Yes

Editorial inference

DDoS mitigation is deployment-specific; standard product entitlement remains unresolved.

Partial

Editorial inference

Recurring control testing; exact cadence unresolved

Editorial inference

Unresolved

A coordinated vulnerability-disclosure programme is not established.

Yes

Verified conclusion

Actual or suspected breaches follow internal reporting and investigation; customer-notification deadlines are contract-specific.

Partial

Supported conclusion

MFA is available as a platform security control; mandatory enforcement for every operator role is not established.

Granular by role, brand and market

Supported conclusion

Yes

Supported conclusion

Yes

Supported conclusion

Yes

Supported conclusion

Yes

Supported conclusion

Yes

Supported conclusion

Regular security testing; cadence unresolved

Supported conclusion

No

Editorial inference

A coordinated vulnerability-disclosure policy, safe-harbor terms and dedicated security-reporting workflow are not established.

Unresolved

Incident-response planning and regulatory notification duties are covered at policy level; customer deadlines and a platform-specific notification procedure remain contract-specific and unresolved.