Network Data Processing Summary
Direct architectural breakdown of what each bot handles, storage duration, and backend providers.
| Bot System | Primary Function | Collected Data | Retention | Storage Backend | Direct Link |
|---|---|---|---|---|---|
|
Server Gate
|
OAuth2 Gatekeeper & Alt/Raid Defense | User ID, Username, Avatar, Account Age timestamp | 10-min CSRF TTL; Persistent verification status | Upstash Redis | Inspect → |
|
Xenon Main
|
Activity Tracking, Ping Defense & Honeypot Auto-Ban | User ID, aggregated message counters, ping protection list | Continuous while user remains in server; Reset on command | Upstash Redis | Inspect → |
|
Xenon Ticket
|
Support Tickets, Billing Queries & Staff Dispute Transcripts | User ID, ticket conversation logs, closure timestamps | Archived in private staff audit logs upon ticket closure | Upstash Redis + Discord Logs | Inspect → |
|
Xenon Tester
|
Private QA Channel Allocation & Device Role Cooldowns | User ID, tester channel ID, device switch timestamps | Duration of tester tenure; 24h rolling cooldown records | Supabase PostgreSQL | Inspect → |
Server Gate Verification Bot
Anti-Raid Verification • OAuth2 Identity Audit • Role Management
When you initiate server access verification through the
/verification or /panel systems:
-
Discord User ID & Username: Retrieved
strictly via Discord OAuth2 using the standardized
identifyscope to associate your account with your server guild member record. - Account Creation Timestamp: Evaluated to ensure the account meets the mandatory 3-day minimum age requirement, insulating the server from throwaway raiding accounts.
- Cryptographic State Token: A randomized one-time CSRF token generated for your session to guarantee that authorization callbacks cannot be spoofed or replayed.
- Verification Outcome: A boolean flag saved in our cache confirming your account passed verification so you do not have to repeat the procedure on every reconnect.
Security and minimalism are paramount to the Server Gate pipeline:
- CSRF State Expiry: All authorization session tokens are stored in Upstash Redis with a strict 10-minute Time-To-Live (TTL) and are permanently purged instantly upon either successful validation or expiration.
-
OAuth2 Tokens: Authorization codes and
temporary access tokens exchanged with
https://discord.com/api/oauth2/tokenare consumed in-memory within the serverless callback and are never written to any persistent database. -
Role Sync: Upon validation, the bot issues
Discord REST commands to attach the server's
Verifiedrole and strip the temporaryUnverifiedrole.
Server Gate Bot operates strictly within least-privilege boundaries:
Xenon Hub Main Bot
Activity Statistics • Automated Honeypot Containment • Ping Protection
To foster community engagement and verify activity thresholds:
- Numerical Counters: The bot processes non-bot message events across server text channels and increments a numeric counter associated with your Discord User ID.
-
Content Disposal: The bot does
not store message text, images, or chat history in
its message counting database. Only the aggregate integer
count (e.g.,
user:12345 = 142 messages) is stored. -
Correction Commands: Administrators may
adjust or reset message tallies using
/messageadd,/messagesub, or/messagereset. Users may view their statistics at any time via/messages.
To protect leadership and developers from mass mention flooding:
- Mention Detection: When an unauthorized user mentions a protected administrator or role (including automatic reply-mentions), the bot deletes the offending message in real time.
- Interactive Redirection: The sender receives an ephemeral dropdown component directing them to the appropriate ticket or support channel. This interaction menu automatically invalidates after 60 seconds.
- Configuration Storage: Protected staff member IDs and allowed-ping whitelists are stored persistently in Upstash Redis.
The server maintains dedicated restricted bait channels to neutralize compromised Discord accounts and scam spam bots:
- Automated Trigger: Any account transmitting messages inside an officially designated honeypot channel triggers instant message deletion followed by the configured sanction (ban or kick).
- Moderation Logging: An audit record including User ID, timestamp, and incident channel is emitted to the staff moderation log channel to maintain accountability.
Xenon Ticket Bot
Support Channels • Purchase Routing • Dispute Transcript Archival
When you open a support or purchase inquiry channel:
-
Ticket Creation Metadata: The bot records
your User ID, ticket sequential ID (e.g.,
ticket-1670), creation timestamp, and assigned inquiry category. -
Transcript Generation Upon Closure: When a
staff member or user closes a ticket using
/close, the bot compiles the messages exchanged inside that private channel into a formatted text transcript (.txtfile). -
Transcript Destination: The transcript is
posted exclusively into an isolated, confidential Discord
staff log channel (
CLOSE_LOG_CHANNEL_ID) to serve as a legal audit trail for resolving transaction disputes, fraud prevention, and quality assurance. - Channel Deletion: The temporary channel is deleted from Discord servers 5 seconds after closure.
Xenon Ticket Bot facilitates purchase options routing (Card, Revolut, PayPal, CashApp, Apple Pay, Robux, etc.):
- Zero Financial Credential Collection: The bot never collects, processes, or stores credit card numbers, CVVs, bank logins, or payment credentials. All transactions occur off-platform via external licensed payment processors (e.g., Revolut or Stripe links).
- Purchase Proof: Any order verification images or receipts provided voluntarily by users inside support tickets are subject to the same transcript archival procedure described above.
To guarantee high support availability:
- The bot enforces concurrent active ticket caps per user (default: max 3 concurrent tickets) and total server limits managed in Redis.
Xenon Tester Bot
Private QA Workspaces • Device Role Cooldowns • Build Distribution
When a member is onboarded into the Xenon QA Beta Testing group
via /promote:
-
Isolated Channel Creation: The bot provisions
a dedicated private channel (e.g.
┆<shortname>デ) under the Tester Category with restrictive permissions granting access exclusively to the target tester and Head Tester leadership. -
Database Mapping: The association between
your Discord User ID and your assigned channel ID is persisted
in our Supabase PostgreSQL table
(
tester_channels) for lifecycle administration. -
Demotion Purge: When removed from the testing
program via
/demote, the personal channel is deleted and the database association is cleanly erased.
Testers self-select their operational device environments (e.g. PC, iOS, Android, macOS):
-
24-Hour Cooldown Enforcer: To prevent
permission thrashing and spam, the exact timestamp of your
latest device role swap is stored in Supabase
(
role_switches). - Cooldown Verification: Any subsequent swap request before 24 hours have elapsed is politely declined with an expiration counter.
Bug reports, test script loader keys, and logs provided by testers within their private channels are accessible only to authorized Xenon management for script debugging and quality refinement.
Global Privacy Standards & Your Legal Rights
Regardless of your jurisdiction, Xenon Hub adheres to international data privacy best practices, including the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
✓ Right to Access & Portability
You have the right to request a complete export of any personal data associated with your Discord User ID across any of our four active bots.
✓ Right to Erasure ("To Be Forgotten")
You may request that your message counts, verification flags, tester records, and cached preferences be permanently deleted from our databases.
✓ Right to Rectification
If any stored record (such as message tallies or role records) is inaccurate, server administrators can rectify it immediately upon request.
✓ Right to Restrict Processing
You can opt out of message count tracking or verification at any time by leaving the Discord server or unlinking your OAuth2 session.
To execute reliable, low-latency bot operations, data is handled strictly by reputable cloud hosting infrastructure providers:
- Discord Inc.: Core messaging API, Gateway events, and OAuth2 authorization flows.
- Upstash Inc.: Serverless low-latency Redis cache for CSRF states, message counts, and ticket counters (TLS 1.3 encrypted).
- Supabase Inc.: Managed PostgreSQL cloud database for tester channels and role swap rate limits (AES-256 encrypted at rest).
- Discloud & Railway: Containerized Node.js application hosting runtime providers.