Security

• Encrypted in transit: all traffic between you, our app, and our infrastructure uses TLS (HTTPS). Your Minecraft client connects to your server over standard encrypted channels where the protocol supports it.
• No card storage: payments are processed entirely by Stripe. Card numbers never touch our servers.
• Secrets stay secret: API keys and credentials live in managed secret stores, never in source code or chat logs. Values that could leak into logs are redacted (for example, RCON traffic).

• Hard multi-tenant isolation: every server runs in its own container, tagged with ownership labels. Database ownership checks back them up — one customer's tools can never touch another customer's server, and cross-tenant operations hard-fail.
• Allowlisted AI tools only: Terra can only call a fixed set of typed server-management tools. She has no raw shell access, no public RCON, and can't forge server or container identities.

• Snapshots before the scary stuff: deleting a server automatically takes a final world snapshot first, and you can snapshot on demand anytime from chat.
• Confirmation-gated destruction: destructive actions always ask for your explicit approval in chat before anything happens.

That said, no backup system is perfect — see the Terms of Service on data loss. Keep your own copies of anything irreplaceable where practical.

• Sign-in is handled by Google OAuth — we don't store passwords, so there's no password database to steal.
• Deleting your account immediately ends your session; personal data is removed within 30 days (billing records required by law excepted).
• Don't share your Google login. If you think your account is compromised, secure your Google account first, then tell us.

Dripstone is an early soft launch run by one person, not a security-certified enterprise. We don't yet have SOC 2, third-party penetration tests, or a bug bounty program — those are aspirations, not claims. What we do have is careful engineering around the things that matter most: isolation between customers, least-privilege AI tools, and snapshots of your world.

Found a security issue? Please don't post it publicly. Email hello@playdripstone.com with details and we'll investigate promptly. We appreciate responsible disclosure and will keep you posted on the fix.