Security
Last updated: September 1, 2026
This page explains, in plain language, how The Roleplay Bot protects your Discord community's data — how you sign in, who can change what, how a payment is handled, and how to tell us if something looks wrong. It is a companion to our Terms of Service and Privacy Policy, which remain the full, governing documents; where this page and either of those disagree, the Terms of Service and Privacy Policy control.
Signing in — Discord OAuth, not a password
You never create or type a password for The Roleplay Bot. You sign in through Discord's own login (OAuth), and Discord — not us — verifies who you are. The permission we ask Discord for at login is deliberately narrow: your basic Discord identity and the list of servers you belong to, so we can show you the right dashboard. We do not request your email address or any permission that would let us act as you outside of what the dashboard itself does.
Your dashboard session is a signed, HttpOnly cookie — it cannot be read by a script running on any page, including ours — sent only over HTTPS in production. Any Discord access token we hold on your behalf so the dashboard can keep working is encrypted before it is stored, never kept in plain text.
Role-based access — nobody gets more than they need
Inside your server, who can do what is decided by real Discord authority (server ownership and Discord's own "Manage Server" / Administrator permissions) combined with the roles and permissions you configure for that server — never a hardcoded list, and never something we grant from our side. You choose which Discord roles can manage promotions, review applications, handle tickets, change settings, and so on, one capability at a time, and you can change or revoke any of it whenever you like. A member who should no longer have access loses it the moment you say so — access is checked fresh, not assumed from an earlier visit.
Every non-GET request the dashboard accepts is checked against your live session and requires a matching anti-forgery token, and repeated or automated attempts are rate-limited — both there specifically to stop a request from being forged or brute-forced from outside the dashboard.
Payments — handled by Paddle, not by us
Paddle.com Market Ltd is our Merchant of Record for every paid plan and add-on. When you pay, you are paying Paddle, and Paddle collects and processes your card or payment details directly — we never see, handle, or store your full card number, expiry, or security code on our systems. See our Pricing page, Terms of Service and Refund Policy for how a purchase, a plan change, and a refund each work.
Verified webhooks
Paddle notifies us when a payment or a subscription changes. Every one of those notifications is cryptographically signed by Paddle, and we verify that signature before we act on it in any way — a message that is not genuinely from Paddle, or that has been altered or replayed, is recorded as rejected and changes nothing on your account. We do not publish the exact mechanics of that check publicly; that is deliberate, and standard practice for anything that can move money.
We collect only what a feature actually needs
We do not collect Discord data "just in case." Server configuration, rosters, and personnel records exist because a feature you turned on needs them to work, and when we take a payment we share with Paddle only what is needed to charge it and match it back to your account — never your Discord identifiers, your server's configuration, or your member records. Our Privacy Policy lists, in full, what is collected and why.
An audit trail for sensitive actions
Sensitive changes inside your server — promotions and demotions, infractions, and changes to who can manage what — are recorded in an append-only history scoped to your own server, so your staff team can see what changed, when, and by whom. It is a record, not an additional permission system: it does not decide who can do something, only remembers that it happened.
Report a vulnerability
If you believe you have found a genuine security vulnerability in The Roleplay Bot — not a feature request, not "this should work differently" — please tell us directly rather than posting it publicly or testing it against a server you do not own or manage.
Where to report
Email support@theroleplaybot.site with a clear description and, if you can, the steps to reproduce it.
What to avoid
Please do not access, modify, or download data that is not yours, and do not run anything that could disrupt the service (denial-of-service testing, automated scanning against production, and similar are not welcome).
What to expect
This is a small, individually-operated platform, so response is best-effort rather than on a guaranteed schedule — but a genuine security report is treated as a priority, and we will acknowledge it and work on a fix.
Disclosure
We ask for reasonable time to investigate and fix a report before it is shared publicly. We do not currently run a paid bug bounty program.
What we do not claim
We do not hold, and do not claim, SOC 2, ISO 27001, PCI DSS, HIPAA, or any other formal security certification for The Roleplay Bot itself. Paddle, as the processor for every payment, maintains its own compliance for handling card data (including PCI DSS) — that compliance is Paddle's, not ours, which is exactly why card details never reach our systems in the first place.
The Roleplay Bot is operated by an individual, not a security team — see "Who operates The Roleplay Bot" in our Terms of Service. What is described on this page is what is actually true of the platform today, not an aspiration.
Questions
For anything else about security, privacy, or how a specific feature handles your data, reach us at support@theroleplaybot.site or see the Support page.