Provably fair · server-authoritative · white-label
Seed commitment
a3f9…7c21 · verified
HMAC-SHA256 over a server seed committed before the round, a client seed the player controls, and a nonce. The commitment hash is published up front and every historical round stays verifiable after a seed rotation — fairness is versioned, so old games never break.
Balances are derived, never stored. Every movement is a double-entry row in an append-only ledger with integer minor units — no floats, no drift, no reconciliation spreadsheet on a Monday morning.
The browser renders. The server decides. There is no outcome-manipulation surface anywhere in the codebase, and the state machine rejects any transition it does not recognise.
An authenticated WebSocket hub pushes reveals, balance changes, and settlements. Drop the connection mid-round and the client resumes from server state — nothing is lost, nothing is double-paid.
Per-player and global exposure caps, bet-rate limits, and configurable RTP through a house-edge basis-point setting. Risk can reject a new bet; it can never reach an outcome.
Five roles — Super Admin, Risk Manager, Finance, Support, Analyst — with mandatory two-factor, typed reasons on every destructive action, and an append-only audit log. Ledger, games, users, risk limits, and settings are all inspectable without a psql session.
Every financial mutation runs in one transaction behind an idempotency key. A retried cash-out pays once, whatever the network did.
One token file carries the palette, type, radii, and motion. Reskin the room to your casino without touching a component, and ship your own art through the asset pipeline.
Bankroll, exposure, house result, and per-player activity, all derived from the same ledger rows the finance team audits. One number, one source — never a dashboard that disagrees with the books.
Money is stored in integer minor units with the currency attached, and every string in the room comes from one place. Adding a market is a data change, not a fork.
Also included
Pick any tile to start. Keyboard works too — tab to a tile, press Enter.
Mines
Simulation — this layout is shuffled in your browser, with no server and no seed commitment. The live game derives every layout from HMAC-SHA256 on the server and publishes its commitment before you bet. Verify a real round.
The player surface: 5×5 board, live multiplier ladder, one-tap cash out.
Every request is a write that moves money inside a transaction.
At 25 concurrent players.
Across the full load and chaos suite.
Including every round before a seed rotation.
Measured 2026-07-29 by our load harness driving the real API and WebSocket, with the application, database, and load generator all sharing one laptop. Treat these as a floor, not a ceiling — we walk through the full methodology, including the constraints that bound each figure, on the call.
The fairness verifier ended our dispute queue. Players stopped asking us to prove the round and started checking it themselves.
We had it running against our own wallet service in nine days. The integration only ever touched the payments boundary — nothing in the game assumed our money model.
The admin panel is the part I did not expect. Roles, two-factor, and a reason field on every destructive action — that is an audit conversation already handled.
As a running, branded instance integrated with your wallet and player accounts — we deploy it, we operate it, and your team gets the admin panel from day one. Source licensing is not something we offer today; if owning the codebase is a hard requirement on your side, say so on the call and we will tell you plainly whether we can get there.
Before a round starts the server commits to a seed by publishing its SHA-256 hash. The mine layout is derived from HMAC-SHA256 over that server seed, a client seed the player sets, and a per-round nonce. After the round the server seed is revealed, so anyone can recompute the layout and confirm it matches. Rotating seeds does not invalidate history: fairness is versioned, and old rounds verify against the rules that were live when they were played.
Yes. The house edge is a basis-point configuration value that feeds the payout mathematics, and the risk engine caps exposure independently. Neither one can reach an outcome — the mine layout is produced by the fairness module, which imports nothing from the money or risk domains and is tested for exactly that.
Payments sit behind one boundary interface, and the ledger is the only thing the game engine talks to for money. For most operators we point the payments adapter at your existing rails and authentication at your identity provider — nothing in the game logic has to change. That is the nine-day path one of our operators took.
A branded, deployed instance is typically two to four weeks, depending on how much of the wallet and KYC integration is on your side. The demo call scopes it properly; you get a written plan afterwards either way.
The building blocks regulators ask about are there: immutable ledger, append-only audit log, role-based admin access with two-factor, reproducible round history, and documented operational procedures. Certification is jurisdiction-specific and we scope it with you — we will not claim a licence we do not hold.
That is the point of the architecture. The engine, state machine, ledger, risk, and fairness modules are game-agnostic; Mines is the first game registered against them. Crash, Dice, Plinko, and Towers follow the same contract.
It depends on scope — white-label rights, traffic, custom games, and support tier all move the number, so a price list on this page would be a guess at your business. Tell us what you are launching on the call and you will have a real number the same week.
Book a demo
Twenty minutes, screen shared, no deck. We open the admin panel, place real bets against a live ledger, verify a round in front of you, and answer the integration questions your engineers sent along.
