SSG GamingIn short
- We protect the confidentiality, integrity and availability of all information we handle.
- Access is need-to-know, data is encrypted in transit, and our platforms are protected against attacks.
- Every member of staff is responsible for security, under a policy approved by management.
- Found a vulnerability? Report it to sales@ssggaming.com.
Why this policy matters
As a B2B iGaming technology provider, SSG Gaming runs white label casino platforms, game and wallet integrations, payment connections and marketing services for operators in many markets. Our partners trust us with business data, platform access and, through their platforms, information about their players.
Protecting that information is essential to our service. This Information Security Policy sets out how we keep information confidential, accurate and available, and who is responsible for making that happen.
Purpose of the policy
The purpose of this policy is to make sure that:
- our core and supporting business operations continue with minimal disruption;
- the integrity and availability of all information we use or store are maintained;
- confidential information is protected through clear procedures for handling, storing and sharing it;
- our information assets are protected from all threats, whether internal or external, deliberate or accidental.
The policy applies to all SSG Gaming staff, contractors and partners who access our systems or information, and to all information we process, in any form.
Our security commitments
This policy has been approved by the Managing Director of SSG Gaming. By putting it into practice, we commit to the following:
Information and essential services are available to authorised users when and where they need them, with minimal disruption.
Information is classified by how sensitive it is, and protected to the matching level against unauthorised disclosure, including partner, personal and communications data.
We meet the legal, regulatory and contractual requirements that apply to our business and to the markets we serve.
Our staff, and relevant contractors and partners, receive security training and understand their duties under this policy.
Information is kept accurate and complete, and protected from unauthorised or accidental change.
All actual or suspected security incidents are reported, investigated and resolved, and lessons are fed back into our controls.
Access to systems and information is granted on a need-to-know, least-privilege basis and removed promptly when no longer needed.
Continuity and recovery plans protect critical business processes from major failures or disasters and keep interruptions short.
How we protect information
We apply layered technical and organisational measures, which we review as threats and our services change. These include:
- Encryption: data is encrypted in transit with HTTPS/TLS, and sensitive data is encrypted at rest where supported.
- Identity and access: individual accounts, strong passwords and multi-factor authentication for administrative access, role-based permissions and regular access reviews.
- Platform protection: DDoS mitigation, web application firewalls and bot protection through our CDN partners, plus network segmentation and hardened server configurations.
- Monitoring and logging: logging of security-relevant events and monitoring for unusual activity, so that incidents are detected and handled quickly.
- Backups and recovery: regular backups, stored separately, with tested restore procedures.
- Secure development: code review, separate test and production environments, and prompt patching of known vulnerabilities.
- Suppliers: game providers, payment partners and other suppliers are selected with security in mind and bound by appropriate contractual obligations.
Responsibilities
- Management approves this policy and provides the resources needed to put it into practice.
- The information security lead, appointed by management, designs, plans, implements and runs this policy, and writes or oversees the related security policies, procedures and guidelines.
- Managers are responsible for putting this policy into practice in their teams and for their staff following it.
- Every member of staff and every contractor must follow this policy and report any security concern straight away.
- Internal review regularly checks that this policy and its controls are working effectively.
Reporting a security issue
If you believe you have found a security vulnerability in our website or services, or suspect that information held by SSG Gaming has been put at risk, please tell us straight away:
Please include enough detail for us to understand and reproduce the issue. Do not access, change or delete data that is not yours, do not disrupt our services, and give us reasonable time to fix the issue before sharing it with anyone else. We will acknowledge your report and keep you informed of our progress.
Review of this policy
We review this policy at least once a year, and sooner after a significant incident or a major change to our business, services or the law. The “Last updated” date at the top shows when it last changed.
Other legal pages