The vocabulary operators, developers and compliance teams actually need — game math, RNG and fairness, certification, wallet and custody, and the commercial models that sit on top. No marketing definitions.
| Term | Definition |
|---|---|
| iGaming | Umbrella term for online gambling — casino, sportsbook, poker and lottery — and the business-to-business technology industry that supplies it. |
| Operator | The licensed business that runs a casino brand, holds the gambling licence, owns the player relationship and is accountable to the regulator. |
| Supplier / provider | A business-to-business company that licenses technology or game content to operators. A supplier does not hold a gambling licence on the operator's behalf. |
| White-label casino | A model where an operator launches under its own brand on a supplier's platform. The operator controls the brand and marketing; the supplier provides games, wallet and back office. |
| Turnkey casino | A more complete package than white-label, typically including the platform plus assistance with licensing, payments and operations. The operator still holds its own licence. |
| Remote Gaming Server (RGS) | The server that runs game logic: it holds the RNG, resolves every bet server-side, applies the configured RTP model and persists the round. The browser only renders results the RGS has already decided. |
| Game aggregator | A middle layer that resells access to many game studios through one integration, taking a share of revenue on rounds routed through it, on top of the originating studio's share. |
| Player Account Management (PAM) | The system of record for players: registration, identity, balances, bonuses, responsible-gambling limits, and the transaction history a regulator will ask to see. |
| Seamless wallet | An integration model where the game server calls the operator's own wallet for balance, debit and credit on every bet, so the operator keeps a single source of truth for money. |
| Transfer wallet | An older model where funds are moved into a game-provider wallet before play and back afterwards. Simpler to build, worse for reconciliation and player experience. |
| Multi-tenant | One platform instance serving many operators with strict data isolation between them — typically enforced at the database level rather than in application code alone. |
| GGR (Gross Gaming Revenue) | Total player wagers minus total player winnings, before deducting bonuses, taxes or fees. The most common base for revenue-share agreements. |
| NGR (Net Gaming Revenue) | GGR minus deductions such as bonus costs, payment fees and gaming taxes. Closer to what the operator actually keeps. |
| Revenue share | A commercial model where the supplier is paid a percentage of GGR or NGR rather than a fixed fee. Standard in iGaming, and stackable when several layers sit between operator and game. |
| Hold percentage | The share of total wagered money the operator retains over time — the practical inverse of RTP, observed rather than theoretical. |
| Sandbox | A non-production environment mirroring live behaviour, used for integration and QA. A good sandbox supports forced outcomes so testers can trigger specific results deliberately. |
| Go-live | The point at which an integration begins accepting real-money play, normally after sandbox sign-off, webhook verification and any required regulatory approval. |
| Term | Definition |
|---|---|
| RTP (Return to Player) | The percentage of total wagered money a game is designed to return to players over a very large number of rounds. A 96% RTP game returns 96 units per 100 wagered in the long run — not within any single session. |
| Theoretical RTP | The RTP calculated analytically from the game's math model and paytable. This is the figure a testing laboratory verifies. |
| Actual RTP | The RTP observed in live play. It converges towards theoretical RTP as volume grows, and deviation alerts on this figure are a standard monitoring control. |
| Volatility / variance | How widely outcomes disperse around the average. Low volatility pays small amounts often; high volatility pays rarely but larger. Two games can share an RTP and feel completely different. |
| Hit frequency | The proportion of rounds that return any win at all, independent of size. A key lever on how a game feels to play. |
| Max win | The largest payout a single round can produce, expressed as a multiple of the bet and enforced server-side so it cannot be exceeded by any combination of features. |
| Paytable | The table mapping winning combinations to payouts. Together with reel composition it determines the game's theoretical RTP. |
| Payline | A defined path across the reels on which matching symbols pay. A 20-payline game evaluates twenty such paths on every spin. |
| Reel strip | The ordered list of symbols on each reel. Reel composition, far more than the paytable alone, drives a slot's volatility. |
| Wild | A symbol that substitutes for other paying symbols to complete combinations. |
| Scatter | A symbol that pays regardless of payline position and typically triggers a feature such as free spins. |
| Free spins | A feature round awarded by a trigger condition, played without deducting further stake from the player's balance. |
| Retrigger | Awarding additional free spins from inside an active free-spins round, extending the feature within the same round. |
| Multiplier | A factor applied to a win or to an accumulating value. In crash and ladder formats, the rising multiplier is the core mechanic rather than a bonus. |
| Math model | The written specification of a game's probabilities, paytable and features, from which theoretical RTP is derived. Testing laboratories review the model, not just the software. |
| Monte Carlo simulation | Running a game's math over millions of simulated rounds to verify that observed RTP matches the theoretical model. Fixed-seed runs make the result reproducible by a third party. |
| House edge | The complement of RTP — the share of wagered money the game is designed to retain. A 96% RTP game has a 4% house edge. |
| Bet level | The stake configuration available to the player. Bet limits are frequently constrained per jurisdiction by the compliance engine. |
| Term | Definition |
|---|---|
| Video slot | The dominant online casino format: a reel grid with paylines, wilds, scatters and feature rounds. Single-step — the player commits a stake and the round resolves at once. |
| Crash game | A session format where a multiplier rises while the round is live and the player chooses when to cash out. Holding longer increases the payout; holding too long ends the round with nothing. |
| Cash-out game | Broader term for any format where the player's decision to stop determines the payout, including crash and ladder variants. |
| Mines game | A pick-and-reveal format where the player uncovers tiles for escalating multipliers, with hidden losing tiles that end the round. Bank at any point or continue. |
| Ladder / tower game | A multi-step climb where each successful step raises the multiplier and the risk, with cash-out available at every rung. |
| Instant game | Short-round, quickly-understood casino formats — crash, mines, ladder, dice, arcade — as distinct from slots and table games. Also called originals or turbo games. |
| Arcade casino game | An instant game with a skill-flavoured interaction layer, such as aiming or timing, sitting on top of a simulated math model that determines the distribution of outcomes. |
| Single-step game | A game where one player action resolves the entire round. |
| Multi-step game | A game where the round advances through several player decisions, each of which can end it. |
| Demo mode | Play with simulated credit and no real-money stake, used for marketing, evaluation and in some jurisdictions required before registration. |
| Term | Definition |
|---|---|
| RNG (Random Number Generator) | The component producing the unpredictable values that determine game outcomes. In regulated gambling it must be cryptographically secure, statistically tested and server-side. |
| PRNG | A pseudorandom number generator — deterministic given its seed. Adequate for simulation, not for money, unless it is cryptographically secure. |
| CSPRNG | A cryptographically secure PRNG: computationally infeasible to predict future outputs or recover past ones from observed values. The required class for real-money gaming. |
| HMAC-DRBG | A deterministic random bit generator built on HMAC, specified in NIST SP 800-90A. Slotty Labs' RNG uses HMAC-DRBG with SHA-512 at 256-bit security strength. |
| NIST SP 800-90A | The US standard specifying approved deterministic random bit generator constructions, including HMAC-DRBG. The reference point most testing laboratories expect an RNG design to cite. |
| NIST SP 800-22 | A statistical test suite for evaluating randomness. Run continuously in production, it detects an RNG degrading over time rather than only at certification. |
| Entropy source | The unpredictable physical or system input that seeds an RNG. Multi-source entropy avoids depending on any single source behaving correctly. |
| Seed | The initial value from which a deterministic generator produces its output sequence. In provably-fair schemes the seed is the object that gets committed and later revealed. |
| Provably fair | A scheme letting a player verify independently that an outcome was not altered after their bet, without trusting the operator — normally via cryptographic commit-reveal. |
| Commit-reveal | The mechanism behind provable fairness: the server publishes a hash of its seed before the bet, then reveals the seed afterwards. The player checks the hash matches and recomputes the outcome. |
| Server seed | The secret value the server commits to before a round and reveals afterwards. |
| Client seed | A value contributed by the player, mixed with the server seed so the server cannot choose an outcome unilaterally. |
| Nonce | A per-round counter combined with the seeds, so a single seed pair generates a distinct, verifiable outcome for every round. |
| Event sourcing | Storing a round as the ordered sequence of events that produced it rather than only its final state, so the round can be reconstructed exactly. |
| Deterministic replay | Re-running a stored round from its event log and obtaining precisely the original result — the practical basis for dispute resolution and laboratory review. |
| Term | Definition |
|---|---|
| GLI-19 | Gaming Laboratories International's standard for Interactive Gaming Systems, covering RNG, game fairness, player account handling, and system security and integrity. The most widely cited reference for online casino platforms. |
| GLI-11 | GLI's standard for gaming devices, frequently referenced alongside GLI-19 for game-level requirements. |
| Testing laboratory | An accredited independent body that reviews gaming systems against a standard and issues certification. Examples include GLI, BMM Testlabs and eCOGRA. |
| Certification | A laboratory's formal attestation that a specific system version meets a named standard, normally scoped to a market and a submission. Certification is completed per market, not held generically. |
| Certification-ready | A system built to a standard's requirements with the evidence package assembled in advance, so laboratory review can begin quickly. Distinct from being certified. |
| Jurisdiction engine | The runtime component enforcing a market's rules — bet limits, mandatory messaging, session controls, permitted features — as configuration rather than as forked code. |
| Curaçao eGaming | A long-established and comparatively accessible licensing jurisdiction, restructured under the Curaçao Gaming Authority. Common first market for new operators. |
| MGA (Malta Gaming Authority) | Malta's regulator, widely regarded as a tier-one European licence with substantial technical and reporting requirements. |
| UKGC (UK Gambling Commission) | The Great Britain regulator, among the most demanding globally, with strict rules on responsible gambling, affordability and advertising. |
| Anjouan | A licensing jurisdiction in the Comoros that has grown as an entry-level alternative to Curaçao. |
| Responsible gambling | Tooling and policy protecting players from harm: deposit and loss limits, session limits, reality checks, self-exclusion and time-outs. Mandatory in every serious jurisdiction. |
| Self-exclusion | A player-initiated block on their own access for a defined period, which the operator must enforce and must not circumvent through marketing. |
| Reality check | A periodic interruption telling the player how long they have been playing and what they have staked. |
| KYC (Know Your Customer) | Identity verification on players, required before withdrawal in most jurisdictions and often at registration or at defined thresholds. |
| AML (Anti-Money Laundering) | Controls detecting and reporting suspicious financial activity, including transaction monitoring and source-of-funds checks. |
| Audit trail | An immutable record of what happened and who did it. Hash-chaining makes it tamper-evident; WORM storage makes it non-erasable. |
| WORM storage | Write Once, Read Many — storage that cannot be modified after writing, used for records that must survive an attempt to alter them. |
| Merkle anchoring | Publishing a Merkle root of a log to an external system so the log's state at a point in time can be proven later. |
| SBOM | A Software Bill of Materials — a machine-readable inventory of components and dependencies, increasingly requested during laboratory review. CycloneDX is a common format. |
| Term | Definition |
|---|---|
| Double-entry ledger | Accounting where every transaction posts equal debits and credits, so the books balance by construction and a missing entry is structurally visible. |
| Hash chain | Linking each ledger entry to a hash of the previous one, so any retroactive edit breaks the chain and becomes detectable. |
| Idempotency key | A unique identifier on a money operation ensuring a retried request produces exactly one posting — the standard defence against double-charging on network retries. |
| Pessimistic locking | Locking a balance row for the duration of a transaction so concurrent operations cannot race it into a negative balance. |
| Reconciliation | Systematically checking that the ledger agrees with external reality — cached balances, payment processors, and for crypto, on-chain holdings. |
| Minor units | Representing money as whole numbers of the smallest denomination (cents, satoshis) rather than decimals, eliminating floating-point rounding drift from the money path. |
| HD wallet | A hierarchical deterministic wallet deriving unlimited addresses from one seed, letting a platform assign each player unique deposit addresses without storing separate keys. |
| Sweeping | Automatically consolidating funds from many player deposit addresses into managed storage, including handling amounts too small to move economically. |
| Sponsored gas | The platform paying network transaction fees so a player does not need a native-token balance to move a stablecoin. Per-tenant budgets prevent fee spikes becoming unbounded cost. |
| HSM / KMS | Hardware Security Module and Key Management Service — systems holding cryptographic keys so that keys are used without ever being exposed as loose material. |
| Cold storage | Keys kept offline, out of reach of any internet-connected system, normally for the majority of reserves. |
| Multisig | Requiring several independent keys to authorise a transaction, so no single person or compromised machine can move funds alone. |
| Solvency verification | Continuously checking that on-chain holdings cover player obligations per currency and per tenant — the crypto equivalent of proving segregated player funds. |
| Stablecoin | A cryptocurrency designed to hold a stable value against a reference asset, typically the US dollar. USDT and USDC dominate iGaming deposits. |
| Term | Definition |
|---|---|
| SDK | A software development kit packaging a platform's API into idiomatic code. Slotty Labs ships an official TypeScript SDK with zero runtime dependencies for Node 18+. |
| Launch token | A short-lived, single-use credential authorising one game session. Slotty Labs uses RS256-signed tokens valid for thirty seconds. |
| RS256 | RSA signature with SHA-256, an asymmetric scheme letting a recipient verify a token's authenticity using only a public key. |
| SSO (Single Sign-On) | Carrying an authenticated identity across systems so a player moves from operator site to game without a second login. |
| Webhook | An HTTP callback the platform sends when an event occurs, so the operator learns about outcomes without polling. |
| HMAC-SHA256 signing | Signing webhook payloads with a shared secret so the recipient can verify the message is authentic and unmodified. |
| Dead-letter queue | Where events land after delivery retries are exhausted, so a receiver outage delays events rather than losing them. |
| Forced outcome | A sandbox facility letting QA specify a result deliberately — a max win, a bust, a disconnect — instead of waiting for probability. |
| Row-level security | Database-enforced access rules restricting which rows a query can see, used to make tenant isolation a property of the database rather than of application code. |
| RBAC | Role-Based Access Control — permissions granted by role rather than per individual, so administrative access is auditable and revocable. |
| MFA | Multi-Factor Authentication — requiring more than a password. TOTP apps and WebAuthn passkeys are the standard second factors for operator back-office accounts. |
| WebAuthn / passkeys | A phishing-resistant authentication standard using device-bound cryptographic keys instead of shared secrets. |
RTP, or Return to Player, is the percentage of total wagered money a game is designed to return over a very large number of rounds. A 96% RTP game returns 96 units per 100 wagered in the long run — it says nothing about any single session.
The RGS runs game logic and decides outcomes. The PAM is the system of record for players — identity, balances, bonuses and limits. An operator needs both; they can come from the same supplier or from different ones.
That the outcome was fixed before you bet and was not changed afterwards. The server publishes a hash of its seed in advance and reveals the seed after the round, so you can check the hash and recompute the result yourself. It does not prove the game's RTP — that comes from the math model and simulation evidence.
No. Certification-ready means the system is built to a standard's requirements and the evidence package is assembled so laboratory review can start quickly. Certification is the laboratory's formal attestation, completed per market as part of an operator's submission.
We are happy to walk through the parts that matter for your market — math evidence, certification scope, custody model — without a sales script.