Your Minecraft accounts and personal data deserve real protection. Here's exactly what we do.
Your Phantom password is run through bcrypt before it touches our database. We store only the hash — not your plaintext password, not a reversible encryption. Even if our database were leaked, your password would be protected.
We never ask for your Minecraft password or session token directly. Authentication goes through Microsoft's own OAuth 2.0 flow — you sign in to Microsoft, and they issue us a scoped access token. Your Microsoft password is never transmitted to or stored by Phantom.
The access and refresh tokens we receive from Microsoft are encrypted with AES-256 before being written to the database, using a key that never exists in the database itself. A database breach alone is not sufficient to recover them.
Dashboard sessions use HttpOnly, Secure, SameSite=Strict cookies. JavaScript running in the browser cannot read your session token. WebSocket streams use short-lived single-use tickets rather than putting the JWT in the URL.
Login and signup endpoints are rate-limited per IP to slow brute-force attempts. Failed login attempts do not reveal whether the email address is registered.
Every login, bot connect, command, and lifecycle event is timestamped and associated with your account. You can review the log from the dashboard at any time. Retention is 7 days on Free, 30 days on Trial/Pro, 1 year on Custom.