Security Obligations

Our Commitment

Serving people well means protecting the data and trust they place in our platforms. Earth Servers builds communication, social, browsing, and gaming software, and we take responsibility for keeping those systems secure, for reviewing them regularly, and for being honest about how we do it.

Last updated: November 1, 2026

Accountable Security Lead

Security lead

Thomas [Brett Sheppard], Founder and Director

Organization

EarthServers Inc., incorporated in British Columbia, Canada

Security contact

[email protected]

Earth Servers is run by a single operator. The security lead is the founder and sole director, who is directly accountable for the security of every system listed below and who personally manages the infrastructure behind them. Administrative access to production systems is held by the security lead only.

Systems in Scope

This page covers the systems and products operated by EarthServers Inc.:

• EarthSocial – social platform
• Company – encrypted messenger
• Earth Reclaim – privacy-focused browser
• EarthGame – multiplayer sandbox game
• EarthWorks – developer SDK
• Decoration – companion app for Company
• EarthCosmetics – community cosmetics mod for Minecraft
• Minecraft and other game servers operated by Earth Servers
• earthservers.net and its subdomains, plus the supporting infrastructure that hosts them

Third-party services we depend on (for example, hosting providers or upstream open-source projects) are governed by their own security practices.

How We Review Our Systems

We run a recurring security review across our own systems, at least quarterly and before significant releases. Each review covers:

• Authentication and session flows – login, token handling, session lifetime, account recovery, and permission checks.
• Input validation – how user-supplied data, uploads, and API requests are validated and handled.
• Dependency audits – known-vulnerability checks on libraries and packages, and prompt updates for serious findings.
• Threat surface analysis – an inventory of exposed services, ports, and endpoints, and the removal of anything we no longer need.

We organize this work using the five functions of the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover) as a reference. We use it as a guide only. We do not currently hold ISO/IEC 27001 certification or a SOC 2 report, and we do not claim to.

We may use AI-assisted tooling to help analyze our own code, logs, and crash data. That work is limited to systems we own and operate.

Incident Response

If we find or are told about a security incident, we will:

• Contain it and assess what systems and data are affected.
• Fix the root cause and rotate any credentials or keys that may be exposed.
• Notify affected users, and regulators where the law requires it, with a clear description of what happened and what to do.
• Record what we learned and update our practices to prevent a repeat.

Reporting a Vulnerability

If you believe you have found a security issue in anything listed above, please email [email protected] with a description, the steps to reproduce it, and the affected product or URL.

What we ask of you

• Give us a reasonable chance to fix the issue before you disclose it publicly.
• Do not access, modify, or keep other people's data beyond what is needed to demonstrate the issue.
• Do not disrupt services or run denial-of-service tests.

What you can expect from us

• An acknowledgement within 3 business days.
• Updates as we investigate and fix the issue.
• No legal action against good-faith research that follows these guidelines.

We do not currently run a paid bug-bounty program.

Defenses

Our security work is focused on protecting our own systems and users. We do not use our tools or AI assistance to attack systems we do not own, to circumvent licensing or copy protection, or for any other harmful purpose.

Together, we build virtual worlds that heal the real one.