How does Alaska keep game keys secure?
Alaska is certified to ISO/IEC 27001:2022. Users sign in with Microsoft single sign-on or with authenticator-app MFA, access is scoped with granular permissions, files are delivered as password-protected zips with the password sent separately, partner API keys are AES-256-GCM encrypted, and every action is in the audit trail.
Last updated
What does the ISO 27001 certification cover?
K3YS Limited is assessed and approved by CQS (Certified Quality Systems) Limited to ISO/IEC 27001:2022. The certification applies to the Information Security Management System for the provision of scalable digital serial key management software, cloud hosting and consultancy for the games industry.
How do people sign in?
With single sign-on through Microsoft Entra ID, or with email and password protected by multi-factor authentication using an authenticator app, which you can make mandatory. Accounts lock after repeated failed logins, and sign-in is standards-based (OpenID Connect / OAuth2).
How are keys protected?
- Files are password-protected zips, with the password sent separately. Every download is logged.
- Keys delivered over the Partner API are encrypted with AES-256-GCM, using a customer-specific key.
- Around 30 fine-grained permissions, scoped by company and territory, keep access least-privilege.
- Secrets are managed outside the code in cloud secret stores.
What stops keys being over-allocated?
- Multi-step approval workflows, with a minimum number of signatures per step.
- Per-request and total-value limits, plus company transaction limits.
- Duplicate detection on upload and a weekly system-wide duplicate scan.
