Engineered for the lab. Ready for the regulator.
Most platforms treat certification as your problem. This one was engineered against GLI-19 (Interactive Gaming Systems) from the first commit — and the lab package is already written. When your engagement begins, testing starts the same day.
Evidence package, prepared
Certification usually means months of your engineers writing documents nobody wants to write. Ours arrive pre-written — evidence package, every claim mapped to its implementation and its evidence.
System architecture
Component topology, data flows, trust boundaries, and deployment model — the map the lab reads first.
RNG & outcome determination
HMAC-DRBG (NIST SP 800-90A) implementation, entropy sources, self-test battery, and the outcome derivation path per game.
Game math & simulation
Written math models plus Monte Carlo RTP evidence per variant verified against theoretical models.
State logging & reconstruction
Event-sourced rounds with round reconstruction — any historical round reconstructed outcome-by-outcome for disputes and lab verification. With provably fair enabled, rounds are also deterministically re-derivable from the committed seed.
Security & access control
Authentication, RBAC with separation of duties, key management, tenant isolation, and transport security.
Operational reporting
GGR and financial reporting, live RTP monitoring with deviation alerts, and regulator evidence export.
Change control
Versioning, release process, and the CycloneDX software bill of materials (SBOM) with source-code packaging tooling for labs.
GLI-19 compliance matrix
Every requirement chapter — RNG, game rules & payouts, player funds, information security, audit & logging — mapped to its concrete implementation and evidence location.
Lab quick-start guide
The package is structured to minimise document discovery and help an accredited lab begin technical review quickly after engagement and scope confirmation.
Prepared for your market entry
Evidence packages are prepared per market, with a submission matrix covering accepted labs, required dossiers, and timelines for each.
Curaçao (eGaming)
Evidence package prepared for Curaçao submissions — commonly the fastest route to a first regulated launch.
Malta (MGA)
Evidence package prepared for Malta Gaming Authority submissions, with the dossier structure MGA reviewers expect.
United Kingdom (UKGC)
The UK evidence package identifies GAMSTOP integration and UK-specific controls required for market entry.
Compliance the platform enforces — not promises
Jurisdiction rules run in the request path. If a bet violates your market's rules, it never reaches the game.
Configurable jurisdiction controls
RTP floors, bet limits, deposit limits, session limits and cooling-off parameters can be configured per operator and jurisdiction.
KYC gating
Verification-state gating on money operations, with suspicious-activity detection hooks feeding the review queue.
Geolocation integration
Launch-time country restrictions are currently supported using operator-supplied country information. Provider-based IP geolocation and continuous location verification can be activated through supported provider adapters.
Self-exclusion
Platform-level temporary and permanent self-exclusion is supported. External national registry integrations are completed as part of the target-market implementation.
GDPR tooling
Data-subject request handling built in — access, rectification, and erasure flows that respect retention obligations and legal holds.
Incident management
Structured incident workflow with regulator-facing reporting — because the question is never if you'll file one, but how fast.
Built for regulators, hostile to tampering
Every significant event is SHA-256 hash-chained — any tampering breaks the chain and is detected. Audit batches are anchored in Merkle trees for independent timestamp proof, with WORM (write-once-read-many) storage support for immutable retention.
One-click evidence export produces packages with cryptographic integrity envelopes — hand a regulator something they can verify themselves.
- Retention classes from 3 to 10 years per record type and jurisdiction, with legal-hold support.
- Live RTP monitoring with deviation alerts across every game and tenant.
- Reconstructable rounds — reconstruct any historical round from its event log.
- Immutable admin audit — every back-office action is hash-chained too.
Responsible gaming toolkit
Deposit, loss, and session limits; reality checks; temporary and permanent self-exclusion; and a flagged-player review queue — implemented in the platform, surfaced in your admin panel.
Gambling can be addictive. Slotty Labs requires all operator partners to provide players with access to responsible-gaming resources — deposit limits, session limits, self-exclusion tools, and links to support organizations such as GamCare, BeGambleAware, and Gambling Therapy. If you or someone you know has a gambling problem, seek help — responsible gambling support is always free and confidential.
What compliance teams ask us
Send this page to your compliance officer
Then book a session — we'll walk through the GLI-19 matrix, the dossier index, and your market's submission path, line by line.