This site uses technical session cookies, a cookie that remembers the language you choose, and minimal control panel preferences. By continuing to browse you accept their use on the terms set out in the privacy and retention policy.
Security
Technical and operational security measures
The server applies security measures that are reasonable for a private, non-public environment, without that implying any absolute guarantee of invulnerability. No system connected to the internet can be considered completely secure.
1. Transport and web access
The panel is configured to force HTTPS.
The panel session uses session cookies with expiry control.
The application validates the username, password length and minimum complexity on the server side.
2. Credentials
Passwords are stored hashed, not in the clear. Neither the administration nor anybody with database access can read yours.
The hash is computed on the login server when the password arrives, and the web panel applies exactly the same scheme, so game and website share a single way of storing them.
Database access is restricted to the server itself: it is not exposed to the internet and is not queried from outside.
The algorithm is MD5, which is what the Ragnarok emulator supports. It is enough that nobody reads your password at a glance, but it is not as resistant as what banks use.
That is why the recommendation stands: use a new password, unique to this site, and do not reuse the one from your email or from any other service.
Passwords are never written in the clear in any log: not in the access logs, not in the change or reset logs, and not in the panel's audit trail.
Web registration asks for a real email address for account management and privacy purposes, but does not use it for marketing or promotional mailings.
Users must choose a new password that they have not reused before.
3. Data minimisation
Asking for unnecessary personal information during sign-up is avoided, and only the minimum email address strictly needed for operational contact and legal compliance is kept.
The technical fields that UnknownCP/rAthena require for compatibility are resolved internally wherever possible.
The M/F profile chosen at sign-up is treated as an in-game avatar setting, not as verification of real identity.
4. Operational containment
The panel and server database is configured for local access in this deployment.
The panel requires groups and permissions for administrative actions.
The game's PIN code system remains enabled as an extra layer over game accounts.
Technical activity is logged for debugging, security and response to abuse.
5. Security on the server Discord
Nobody is going to ask you for your password
The administration will never ask you for your password, not on Discord, not by email, not in the game, and not "just to check something". Anyone asking for it is trying to steal it, however much their name looks like an administrator's.
Nor will anyone ask on Discord for recovery codes, PINs or banking details. There is no procedure that needs them.
Any sensitive account business is done from the web panel, with you typing the address into your browser. Never from a link somebody sent you.
Impersonation and links
On Discord anyone can use whatever name and avatar they like. Check the exact username before trusting a direct message, especially if it is in a hurry or promising you something.
Do not open links or download files sent to you privately by somebody you do not know. The installer and the client updates only come from this website.
If you receive anything like that, tell us: if it reached you, it is probably reaching other people too.
Your Discord account is yours
Discord is a third-party service. Its security, its backups and its data are governed by its own terms, not by ours.
Turn on two-factor authentication on your Discord account and use a different password there from the server one. A stolen Discord account is enough to impersonate you to the rest of the community.
Private messages between users are neither seen nor stored by the administration. If something happens there, you need to report it with screenshots.
6. Security disclaimer
Although reasonable measures are applied, the user accepts that incidents, faults, unauthorised access, outages or loss of information may occur. For that reason, passwords from other services should not be reused, and real personal data should not be uploaded to the panel or to the game.
