How We Protect Your Account
Our security plugin records what happens on your account, checks where it is played from, and puts the controls on your order page.
What the Plugin Does
Our workers play through RuneLite with the Peng security plugin. While they play, it reports to us, and your order page shows it under Account Security.
- 01
A Record of Every Session
Logins, logouts, world hops, deaths, drops, trades, Grand Exchange offers and the value of the bank are recorded as they happen, with the time and the world. You see them on your order page.
- 02
A Record Nobody Can Rewrite
Each entry carries a fingerprint of the one before it, so changing or removing one later would show. When the order closes, the final fingerprint is posted in your order chat: you keep a copy we cannot change.
- 03
Played From Your Country
Tell us the country your account normally logs in from. The plugin will not start a session from anywhere else, and you are told when someone tries.
- 04
Your Account Only
The job is tied to your game account at the first login. A login on a different account ends the session, and you are told.
- 05
Logged Out If Contact Is Lost
If the plugin loses contact with us, the game logs out. If the connection changes in the middle of play, for example a VPN dropping, the client closes. Either way, the gap is on the record.
- 06
No Outside Plugins
Your worker's RuneLite runs with RuneLite's own plugins only, started by our launcher. Switching on any other plugin ends the session, and developer mode is refused.
- 07
Alerts in Your Order Chat
Deaths, risky world hops, valuable drops, trades, odd Grand Exchange prices and refused connections are posted in your order chat as they happen.
- 08
You Hold the Controls
From your order page you can take a screenshot of the game, log your worker out, close their client, or lock the order. Nobody can log in to a locked order until staff have looked at it.
Jagex Accounts
Your Login, Not Your Password
If your account uses a Jagex Account, you do not give anyone your email, password or authenticator. You paste a login file from RuneLite on your order page instead; it takes about two minutes, and the page shows you how.
- It is stored encrypted, for that order only, and never shown again: not to your worker, not to staff. The order page only says that one is stored.
- Only your worker's linked PC receives it, and only while they are working your order. RuneLite logs in with it; your worker never sees it.
- It is deleted when the order closes, and your order chat reminds you to press End sessions.
- Press End sessions after every order (runescape.com, Account settings). It ends every saved login on your account, ours included. Until then, whoever holds the login can play the account, which is why we encrypt it, give it to one PC and delete it at the end.
What We Keep
- Your worker's internet address is used for the country check and cleared after 30 days. The country and city stay on the record.
- Screenshots show the game window only, never anyone’s desktop.
- The record and its screenshots are kept after the order closes, so they can settle a dispute that comes up months later.
- Your Jagex login, if you gave us one, is deleted when the order closes.
Honest Limits
What the plugin does not do, so you know where your own care still counts.
- We are adding the plugin worker by worker. Your order page shows an Account Security section when your job is covered; if it does not, ask us in the order chat.
- It sees play through RuneLite on the worker's linked PC, and nothing else. The country check, the account link and End sessions are what cover the rest.
- The country check goes by the internet address the game is played from. It tells us where the connection is, not who is at the keyboard.
- Nothing replaces your own security: keep two-factor authentication on your email, and press End sessions after every order.
See It on Your Order
Open an order from your dashboard: Account Security sits on the order page, with the record, the alerts and the controls.