Security & data

Your players stay yours.

VOKO works with your player ID and the events you send. Each operator's data is isolated from every other client, and everything in transit is encrypted with TLS 1.2 or higher.

Client documentation

What we receive, and what we don't

VOKO needs behaviour, not identity. You identify players by your own internal ID, and no VOKO product stores a name, email, address or payment details. Pitboss included, although it reads from your data warehouse.

Kept apart. Encrypted. Signed.

Clients never share a data store. Events and triggers go server to server, and our calls back to you are signed.

Isolated per operator

Each operator’s data is held separately from every other client, from events to the mechanics you configure.

Your settings, your brands

Configuration, themes and segments belong to your organisation and are visible only to your team.

Encrypted in transit

Everything between your platform, your players and VOKO is encrypted with TLS 1.2 or higher.

Keys stay on your backend

Triggers and events go server to server. Your credentials never reach a player’s browser.

Signed callbacks

Every call we make to your platform is signed with a secret only you and we hold.

No money in the widget

The widget shows mechanics. Balances and payouts stay on your platform, behind your own checks.

Who is responsible for what

VOKO is a technology vendor. We run the platform; you run your casino, your players and your licence.

VOKO
You, the operator
Platform availability
Security of the VOKO platform
Isolation of your data from other clients
Crediting bonuses and prizes
KYC, AML and player checks
Licence and local gaming-law compliance
Accuracy of the events you send
Protecting player data on your side

Gamification by Gamixter runs the mechanic; your platform credits the reward, through your own bonus and wallet systems.

For your security review

If your due diligence has a questionnaire, send it to us. We walk your CTO or security team through each of these points on a call.

  • Your player ID. Your own internal ID for the player. We never need to know who they are.
  • Gameplay events. Bets, wins and losses, with the amount and the game they happened in.
  • Payment events. Deposits and withdrawals as amounts, never card or account details.
  • Segments. The segment names you already use in your CRM or platform, such as "vip" or "depositor".

Never: names, email addresses, postal addresses or payment details. The events we accept have no place for them.

Every call VOKO makes to your platform is signed with a secret only you and we hold. Your platform checks the signature before it acts. How to verify it is in the client documentation.
Gamification by Gamixter runs the mechanic; your platform credits the reward, through your own bonus and wallet systems. In VOKO, each action is identified uniquely, so a replayed event never pays a bonus twice. For the integration flow itself, see integrations.
Kill switches stop one journey or the whole organisation, effect caps delay anything above the cap, and a replayed event never pays twice. More on how journeys are built and published on the VOKO page.

Detailed security documentation is available to clients in the client documentation (login required), or under NDA during your review.

Client documentation