Bot with only the permissions it needs
The bot never asks for administrator rights, only seven permissions it needs for tickets. Which ones and why is explained in the help center.
Security & privacy
How we protect your server and your data
A plain-language explanation of the safeguards MeinTicketbot uses, which data we process and how long we keep it.
To be transparent: we built and continuously test the following measures ourselves. There is no independent security audit or certification yet – once there is one, it will be listed here.
Safeguards
Sign-in only via Discord
You only enter your password on discord.com – we never see it. The dashboard re-checks your permissions with Discord regularly; whoever loses them there loses access here too.
Two-factor sign-in
Optionally the dashboard also asks for a code from your authenticator app. For operator accounts it is mandatory, along with separate roles in the administration.
Stored encrypted
Access tokens, credentials and other secrets are stored encrypted. API keys are only kept as an irreversible hash.
Encrypted connections
The whole website runs over HTTPS and the Cloudflare network; the connection between Cloudflare and our server is encrypted and verified as well.
Verified senders
Clicks from Discord and messages from Stripe and PayPal are verified by signature. Outgoing webhooks are signed by us so receivers can verify them.
Strict separation of servers
Each server only sees its own tickets, settings and statistics. Every dashboard request checks that you are authorised for exactly that server.
Abuse protection
Forms are protected against cross-site requests (CSRF), sign-ins and actions are rate-limited, and security headers restrict what the browser may load.
Daily backups
The database is backed up daily and every backup is checked for readability. We keep the last 14 backups on the server, and a copy is stored outside the server every day. Monitoring alerts us to outages promptly.
Privacy at a glance
Summary – the full privacy policy is authoritative.
| Data | Purpose | Retention |
|---|---|---|
| Discord account (ID, name, avatar, access token encrypted) | Sign-in, permission checks, server list | As long as you use the service or until you request deletion |
| Server settings (panels, forms, rules, snippets) | Running your ticket system | As long as the server uses the service |
| Tickets, form answers, notes, ratings | Handling and evaluation by your team | As long as the server uses the service or until deletion |
| Transcripts (messages of a ticket channel) | Archive and record | 90, 365, 730 or 1825 days depending on the plan, then deleted automatically |
| Audit log (who changed what) | Traceability within the team | Visible for 7, 90, 365 or 1825 days depending on the plan |
| Payments | Processed by Stripe or PayPal – we never see card or account details | Booking records per statutory periods, usually up to 10 years |
| Contact form | Answering your request | 180 days |
| Push notifications (only if you enable them) | Alerts about new tickets on your device | Until you turn them off |
| Live demo (sample data, separate database) | Trying the service without signing in | 2 hours, then deleted automatically |
| Visitor statistics (no IP address, no third parties) | Website reach | 400 days |
Services we use
- Discord – sign-in and bot
- Cloudflare – delivery and protection of the website, spam protection for the contact form
- Stripe and PayPal – payments
- Your browser’s push service – only if you enable push notifications, content end-to-end encrypted
- Top.gg – only if you vote for our bot there
- Hosting provider – operating server and database on our behalf
No ad trackers, no third-party analytics, no selling of data. For deletion or information, a message via the contact form is enough. You can also revoke access at any time in Discord under “Authorized Apps”.
Availability
Whether bot, dashboard and automations are running right now is always shown on the status page, where we also announce maintenance.
Found a vulnerability?
Please report it confidentially via the contact form and do not publish it before we have fixed it. We will reply as quickly as possible.