Security
Security, privacy and player protection
Fortuna processes data of casinos and their guests. This page explains where it is stored, who sees it and how the app protects players.
- Data centre of the database
- Frankfurt
- Roles with their own permissions
- 7
- Countries with a helpline in the app
- 6
- Minimum age for every account
- 18+
Hosting
Data in Frankfurt
Database, sign-in and files of the apps are stored in a data centre in Frankfurt am Main.
Supabase in the EU
Supabase runs the database, authentication and file storage in the Frankfurt data centre (AWS eu-central-1).
Data processing agreement
A data processing agreement including EU Standard Contractual Clauses is in place with Supabase.
Encrypted transfer
Apps and servers communicate exclusively over TLS. Passwords are never stored in plain text.
Other providers
Push notifications are delivered by Firebase Cloud Messaging, certified under the EU-U.S. Data Privacy Framework.
Tenant separation
Each casino sees only its data
The separation is defined in the database, not only in the interface.
Row level security
Access rules in the database check on every query which casino a record belongs to.
Roles per casino
Seven roles define what a staff member sees and may change. The marketing role sees no personal data.
Log
Staff actions at tables and waitlists are logged with time, person, role and reason.
One account, separate data
Players use one account for all casinos, registrations and check-ins stay with the respective casino.
Player app
No tracking SDKs
The player app contains no advertising or analytics libraries and passes no data to advertising networks.
Firebase only for push
Firebase is included only for push notifications, without Analytics and without Crashlytics.
No location, no advertising ID
The app does not request the location and does not read an advertising ID.
Only what the app needs
Name, email, date of birth for the age check, phone number and profile photo if the player wants, plus registrations and check-ins.
Marketing only with consent
Marketing notifications are off by default.
Player protection
Player protection in the app
The protection features are part of the app, not an add-on module.
Minimum age
Every account requires a minimum age of 18. The app checks a higher minimum age of the casino on every sign-up.
Self-exclusion
For 30, 90 or 180 days, permanently or on chosen weekdays, for one casino, several or all.
Helplines
Counselling numbers for Germany, Switzerland, Austria, France, the Netherlands and Poland, callable directly from the app.
No exclusion register
The self-exclusion is not an official exclusion. Fortuna is not connected to the German OASIS register, the check stays with the casino.
Account deletion
Delete the account in the app
Players delete their account themselves in the app settings.
Deleted
Profile, profile photo, notifications and push token, favourites, support tickets and expired self-exclusions.
Anonymised
Game history and check-in times lose their personal reference, only anonymous operating data of the casinos remains.
No way around it
During an active self-exclusion, deletion is paused so that an exclusion cannot be bypassed with a new account.
Report a vulnerability
Please send vulnerability reports to support@fortuna-solutions.de, ideally with steps to reproduce. The contact details are also in our security.txt.
See Fortuna in your poker room
We show you the apps in a demo. The Fortuna team takes care of the set-up.