Aeion BaaS Security Architecture
Game backends face attack vectors general SaaS doesn't — currency duplication exploits, win-rate manipulation, account farming, RMT (real-money trading), wallhacks + aimbots + speed hacks. Aeion's defense: sandboxed QuickJS WASM for cloud functions, double-entry currency ledger making duplication mathematically impossible, a rule-based anti-cheat engine with auto-flagging + ban appeals workflow, AES-256-GCM at rest for sensitive data, GDPR delete + export pipeline, COPPA age-gating pattern.
Defense-in-Depth Inventory
Cloud function sandbox
QuickJS WASM — no host syscalls, no filesystem access, no network egress beyond declared allowlist
Currency integrity
double-entry ledger — every transaction has debit + credit; no path to mint without audited entry
Anti-cheat
rule-based engine — impossible velocity, statistical win-rate anomaly, server-client desync detection, etc.
Ban pipeline
automated + appealable, with a full appeals workflow
Rate limiting
Redis-backed per-player + per-IP + per-route, with full violation tracking for audit
Encryption at rest
AES-256-GCM for player secrets, function source code, and API keys
GDPR pipeline
handles right-to-erase + right-to-export within statutory windows (30 days default)
Age-gating
COPPA-compliant flow for under-13 (US) and under-16 (EU) users — restricted features + parental consent
Audit log
every privileged action is recorded — currency movements, bans, and anti-cheat flags — preserving full security history
Backup integrity
Aegis pgBackRest WAL archiving with S3 Object Lock — tamper-evident at storage layer
QuickJS WASM Sandbox — Why It Matters
Cloud functions in BaaS platforms typically run in container-based isolates (Firebase Functions = Cloud Run; AWS Lambda = Firecracker microVM). They're secure but heavyweight, with cold-start latency of 200-1000ms.
Double-Entry Currency Ledger — The Anti-Duplication Architecture
Virtual currency duplication exploits are the #1 economy-breaking attack vector in F2P games. Aeion's currency ledger uses double-entry accounting to make duplication mathematically impossible.
Anti-Cheat — Rule-Based Detection
Aeion's anti-cheat engine runs configurable rules over player actions, flagging suspicious behavior + escalating to bans.
GDPR + COPPA Pipeline
Games face two compliance frameworks that general SaaS doesn't:
Encryption at Rest
| Data class | Encryption |
Compliance Mapping
| Framework | Control | Aeion BaaS evidence |