Security
Your active key never leaves your hands.
Overseer was designed to need as little as possible: only the posting key, kept in a vault that signs nothing but what a match bot needs. Nothing that moves your funds or your cards.
| In-game action | Posting | Active | Does Overseer do it? |
|---|---|---|---|
| Join matches and submit the team | Yes | ||
| Claim rewards (daily, league, Fortune Draw, SPS) | Yes | ||
| Transfer DEC, SPS or cards | — | Never | |
| Sell, rent or delegate cards | — | Never |
Some in-game purchases accept the posting key — that's why our vault refuses every purchase, sale or rental, even the ones the posting key would allow. The owner key, the strongest one on the account, is never requested either.
The vault
How we store your posting key
- 1
We check the key on Hive
At sign-up, Overseer checks on the blockchain that the key really is the account's posting key. Active and owner keys are rejected on the spot — the product never stores a key that can move funds.
- 2
It goes straight into the vault
The key passes through the website only once, on its way to an isolated signer: a separate service, with no internet access, that encrypts the key for your account alone (AES-256-GCM, with its own encryption key per account).
- 3
The website never sees it again
When the bot needs to play, it asks the signer to “sign this move for account X” and receives only the signature. The key itself never goes back to the website, the database or the logs.
- 4
The vault only signs what was agreed
The signer accepts a closed list of actions: joining and playing Wild matches and claiming rewards. Purchases, sales, rentals, transfers and the Modern format are refused by it — even if someone asks.
You're in control
Leaving is as easy as joining
Turn it off anytime
One click in the dashboard. A match in progress finishes normally — no loss for abandoning.
Remove it and the key leaves the database
When you remove the account, the key leaves our database immediately. Encrypted backups still keep it for up to 5 weeks — to cut everything off for good, change your posting key on Hive.
Change your posting key on Hive
It's the definitive cut: the old key stops working for everything, including Overseer.
We notice on our own
If the stored posting key stops working, Overseer checks on Hive, deletes the key and turns the account off — and the dashboard asks for a new posting key.
Good practices
No one from Overseer will ever ask for your active key.
- Never hand over your active key, owner key or master password — not even to us. Anyone asking on behalf of Overseer is attempting a scam.
- Add your posting key only in the Overseer dashboard, after signing in with your email and password.
- Use a strong, unique password for Overseer, and protect your account's email.
- When in doubt, change your posting key on Hive: it cuts off any access immediately, including ours.