Xenon
Anmelden
Xenon hinzufügen

Funktionen

Server-BackupsKanäle, Rollen und Nachrichten sichern und zurückholenServer-VorlagenMit einem Aufbau starten, den die Community gebaut hatServer klonenEinen deiner Server auf einen anderen kopierenSyncNachrichten, Banns und Rollen zwischen Servern spiegeln
PremiumDokumentation

Sprache

EnglishDeutschPortuguês

Security Measures

Last updated

This page describes the technical and organizational measures the Company applies to Discord Data, as they are implemented today. It forms part of the Data Processing Addendum as the description under Article 28(3)(c) and Article 32 GDPR. The DPA states what the measures must achieve; this page says how they do it, and it is the page that changes when the implementation does.

Encryption

  • In transit: traffic between You and the Service, between the Service and Discord, and between the Service and its Sub-processors is encrypted with TLS. Traffic between the Company’s own systems runs over an encrypted private network.
  • At rest: the database holding Discord Data is stored on an encrypted volume (LUKS2) whose passphrase is held by a person rather than by the machine, and its backups are encrypted with AES-256 before they leave the server. Objects in Our storage provider, and the copies of them We keep, are encrypted individually with AES-256 using a key We supply on each request and which the provider does not retain.

Access control

  • Production systems accept no password logins. Administrative access is possible only over the Company’s private network, which is closed to the public internet, and only by SSH key held by the Company; the hosting provider accounts underneath require multi-factor authentication.
  • Standing access to production is held by the Company’s operator alone; no third party holds it.
  • The Company’s administrative tools are served on that private network only.
  • Application access to Discord Data is scoped to the Workspace that owns it and enforced on every request.

Separation

  • Discord Data is stored per Workspace and is not commingled between customers.
  • Production data is not used in development or test environments.

Minimization of Discord permissions

  • The bot’s gateway subscriptions are limited to the events the features of the Service consume. Direct messages, voice states, presences and typing are not among them.
  • Backups, chatlogs and templates need only the permissions to read Your Server, and that is what the Company recommends granting. Restoring or synchronizing a Server recreates channels, roles and permission overwrites and therefore needs the Administrator permission for as long as the restore runs or the synchronization is active; the Company recommends granting it for that purpose and withdrawing it once it is no longer needed.
  • The permissions the bot holds in Your Server are set by You and can be changed by You at any time.

Availability

  • Regular backups of the systems holding Discord Data, kept encrypted and overwritten on a rotation cycle of up to 35 days.
  • Monitoring of availability and errors, with alerting to the Company.

Traceability

  • Operations started through the Service are recorded in the audit log of the Workspace, identifying who started them and when.

Deletion

  • Routines remove Discord Data from primary storage and from object storage when an artifact or a Workspace is deleted, without undue delay and at the latest within 30 days.
  • Residual copies in infrastructure backups expire on the rotation cycle above.

Changes to this page

The Company may change a measure without reducing the overall level of protection. Changes are announced as the DPA sets out under “Term and Changes”.

History

  • 2026-09-16: measures published as their own page. They are the ones described in the DPA since 2026-07-30.

The other policies