How SteamStats protects your keys and data

Steamworks keys are encrypted at rest

When you save a Steamworks key, the server encrypts it before it reaches the database. Each saved key gets a fresh 256-bit data key and is sealed with AES-256-GCM. The ciphertext is bound to your organization and to the key's type, so a copy moved to another organization does not decrypt.

The data key is then wrapped with a 3072-bit RSA public key (RSA-OAEP with SHA-256). The website holds only that public key. The private key is available only to the background service that calls Steam, so the website itself cannot read a saved key.

A saved key is never shown again, in the app or in any response. Owners and admins can replace or remove it at any time; removing it stops wishlist and sales fetches and keeps the history already collected.

Each studio sees only its own data

Strict tenant isolation: every game, number, key and support message belongs to one organization, and SteamStats returns it only to that organization's signed-in members. The separation is enforced at the data layer, not only in the screens you see.

An automated isolation test signs in as one organization and checks that another organization's games, numbers and support tickets never appear in its pages or responses.

Careful use of your Steam key

• SteamStats uses your key only to read the reports of the games you add.
• Requests made with your key stay well within the limits Steam sets.
• The first time Steam rejects a key, SteamStats stops using it and the app marks it as disabled. A rejected key is never retried in a loop.

Signing in and roles

There are no passwords. You sign in with a link sent to your email address, valid for 5 minutes, or with a passkey saved on your device.

In each organization, owners and admins change settings, keys, billing and the team; members can see every page but change nothing.

In the browser

• A Content Security Policy on every page lets only SteamStats's own scripts run; an inline script that SteamStats did not ship is blocked.
• Other sites cannot show SteamStats inside a frame.
• In production, browsers are told to reach SteamStats over HTTPS only (HTTP Strict Transport Security).
• A link to another site sends only the SteamStats address, never the page path or query.
• The browser's camera, microphone and location features are switched off on every page.
• The public site sets only strictly necessary cookies and loads no advertising scripts. Analytics, once switched on, loads only after you allow it in Cookie settings. Signing in sets a session cookie.

Logs and records

• Before a log line is written, values that look like keys, tokens, cookies, passwords or authorization headers are replaced with [redacted].
• Steam keys never appear in logs.
• Every number on screen can be traced back to the Steam report it came from.
• Every change to the code base is scanned for leaked keys and tokens.

The browser extension

The optional SteamStats for Steamworks extension works while you are signed in to Steamworks in that browser. It opens only Steamworks report pages, never signs in for you and stores no password. Its connection to SteamStats can only import reports, and you can disconnect it in SteamStats at any time.

What SteamStats stores

• Your account: name, email address and your organization's settings.
• With your Steamworks financial key: the wishlist and sales reports of the games you add.
• From public Steam pages: reviews with the author's public Steam name and avatar, Community Hub threads, player counts, followers and store-list ranks for your games and for the similar games shown in Market.
• If you connect them: traffic, UTM, refund and wishlist cohort reports from Steamworks.
• Payments are handled by Paddle, the merchant of record; SteamStats does not receive card numbers.

What this page does not claim

SteamStats does not hold a SOC 2 or ISO 27001 certification. This page describes what the product does today and changes when the product does. Security reports go to support@steamstats.io.