Methodology
What we check, and how
Every decision Oyun Kontrol makes rests on the rules on this page. When the rules change, this page changes.
Process
- 1
Ownership
The applicant places the code we give as a DNS TXT record (_oyunkontrol.domain or domain), a /.well-known/oyunkontrol.txt file or an oyunkontrol-verification meta tag. Mirror domains are verified with the same code.
- 2
Automatic scan
Our scanner reads the home page and the linked policy pages, inspects the TLS handshake, and looks at DNS and domain registration data. It does not log in, submit forms or play games.
- 3
Result
If every required check passes, the scan passes. If one does not, the owner is told what is missing and how to fix it. If the site cannot be read (bot wall, country block, script-only page) the result is “inconclusive”.
- 4
Representative review
Every inconclusive file, and every file awaiting approval, is assigned to a representative who applies the same checklist by hand and writes a recommendation; a team manager makes the final decision.
- 5
Seal and monitoring
A sealed site is scanned again every day. If a required check fails twice in a row the seal is suspended; it comes back by itself once fixed. If the ownership record is missing on three scans in a row, that domain leaves the coverage.
Checklist
No seal is issued until every “required” check passes. “Recommended” checks do not lower the result; they appear as notes in the report.
Identity and ownership
| Check | What we look at | Online casino | Game provider |
|---|---|---|---|
| Domain ownership | The applicant proves control of the domain with a DNS record, a verification file or a meta tag. | Required | Required |
| Reachability | The home page opens for our scanner and returns a real page. | Required | Required |
| Domain history | The registration date is read; very new domains are noted. | Recommended | Recommended |
| Seal in place | The issued seal is actually shown on the site. | Recommended | Recommended |
Connection security
| Check | What we look at | Online casino | Game provider |
|---|---|---|---|
| Valid TLS certificate | The certificate is trusted, issued for this domain and not about to expire. | Required | Required |
| Modern encryption | Connections use TLS 1.2 or 1.3. | Required | Required |
| HTTPS redirect | Visitors on the plain-text address are sent to the secure one. | Recommended | Recommended |
| HSTS | Browsers are told to open the site over secure connections only. | Recommended | Recommended |
| Security headers | Framing, content-type and referrer protection headers. | Recommended | Recommended |
| Mixed content | The secure page loads no plain-text resources. | Recommended | Recommended |
Policies
| Check | What we look at | Online casino | Game provider |
|---|---|---|---|
| Terms and conditions | A terms and conditions page is reachable from the site; for game providers a legal notice page also counts. | Required | Required |
| Privacy policy | The site explains how personal data is handled. | Required | Required |
| Contact details | Players and partners can reach the site. | Required | Required |
Player protection
| Check | What we look at | Online casino | Game provider |
|---|---|---|---|
| Responsible gaming | Limits, time-outs, self-exclusion or links to help organisations are offered. | Required | Recommended |
| Age limit | The site states that it does not serve players under 18. | Required | Not applicable |
| KYC and AML | Identity verification and anti-money-laundering policy is published. | Recommended | Not applicable |
Game fairness
| Check | What we look at | Online casino | Game provider |
|---|---|---|---|
| Fairness disclosure | RTP figures, game rules, a provably fair explanation or an independent testing-lab certificate are published. | Recommended | Required |
How the score is calculated
The score in the panel is for information: required checks weigh 3, recommended checks 1; a pass earns the full weight, a pass with notes half. The seal decision depends on the required checks, not on the score.
About our scanner →Limits of the method
- We do not test game source code or random number generators (RNG) in a laboratory.
- We do not decide where a site may legally operate; the seal is not a licence.
- We do not audit player balances, payment processes or the quality of customer service.
- Checks show the state at scan time; daily monitoring shortens that window but does not remove it.