This page describes what AstroShield does with data and what you should protect. It is a description of how the product works, not legal advice. The binding wording is in the Terms and Conditions.
What data is processed#
To enforce bans and detect fraud, AstroShield processes the following about players who join a protected server:
| Data | Where it comes from |
|---|---|
| Discord ID | The player's identifiers when they connect. |
| FiveM ID, Xbox Live license, Steam ID, Rockstar license | The same. |
| Hardware ID (HWID) and player tokens | The same. |
| IP address | The player's connection. |
| System information and server logs | The detection data and console output that the resource reports. |
The Terms state that this data is used for anticheat enforcement, fraud detection and service improvement. Webhooks send logs to your Discord, and AstroShield has no access to those channels.
As a server owner you are responsible for what happens on your server, including every ban. Tell your players in your rules that you run an anticheat and what it records.
Evidence and recordings#
AstroShield can capture the game view of a player. It never captures the desktop.
- Rolling buffer. The game keeps a short recording of the game view, about the last 40 seconds, on the player's computer. Nothing leaves the computer unless one of the cases below happens.
- Ban evidence. When a detection leads to a ban, the player's client uploads a short clip, and the link is stored in the ban record. See Punishments.
- Replay. Staff with the right permission can ask for the buffer of an online player. See Players.
- Screen View. A live view that only starts when staff ask for it. See Live map and screen view.
Clips are uploaded straight from the player's game to a third-party file host, catbox.moe, and AstroShield stores the link. Anyone who has the link can open the clip, because it is not protected by a login. Treat evidence links as sensitive and do not post them in public channels.
Clipboard check#
The Anti Clipboard Injection detection looks at text that is copied or pasted inside the game window and compares it, on the player's computer, with a list of known cheat-code snippets. Text that does not match is not sent anywhere. When the same kind of match happens repeatedly, up to the first 2000 characters of the text are reported as evidence with the detection. That evidence is part of the case and of your ban webhook message.
Protect your setup#
The short list
- Keep your
.keyfile private. See License key. - Treat your Discord webhook URLs as secrets. AstroShield never sends them to players' clients, but anyone who sees them can post to your channel.
- Turn on two-factor authentication for every account that manages a server. See Account and security.
- Give each admin only the permissions they need. Console, Custom Rules, Configuration and Administrators are the powerful ones.
- Check the audit log now and then, and remove admins who no longer need access.
A few things AstroShield does for you:
- The configuration that is sent to players' clients has all secrets removed, such as webhook URLs.
- The dashboard checks the permission of each person on the backend for every console command and every live request, not only when a page opens.
- The live connection of the dashboard uses a token that expires after five minutes, and it is only issued to a signed-in account that has passed two-factor authentication, when that is enabled.
- The core logic of the resource is obfuscated, and the Terms forbid reverse engineering it.
Third parties#
AstroShield relies on a few other services:
- Tebex processes payments.
- Discord handles sign-in and your webhooks.
- A file host stores evidence clips, see above.
Their own terms and privacy policies apply to what they do.
Report a security issue#
If you find a vulnerability in the dashboard, the resource or the backend, please report it privately: email astroshield@gmail.com or message staff on Discord. Do not post it publicly before it is fixed. If you found a way around a detection, report that privately too.