A.C.E / ANTI-CHEAT
A.C.E Shield threat model
What the A.C.E anti-cheat protects against, what it cannot catch, and how decisions are made. Last updated 26 October 2026. See also the Anti-Cheat page and the Privacy Policy.
What A.C.E Shield is
- A user-mode anti-cheat inside the A.C.E desktop app for Windows, plus server-side checks on A.C.E match servers. There is no kernel driver.
- The desktop part runs only after the player accepts the consent screen, and checks only while CS2 is running.
- Ranked play is fail-closed: without a live, verified Shield session a player cannot queue or join an A.C.E match server.
What it is designed to stop
- Known external cheat tools: running programs and window titles matched against a signed, regularly updated list.
- Code injected into CS2: modules loaded into cs2.exe and whether they are digitally signed, and tools known to open CS2's memory.
- Modified game files and disallowed launch options: hashes of core CS2 files compared with what the player base reports.
- Tampering with the A.C.E app itself: a modified app refuses to start, unpacked code is never run, debuggers and inspection switches are reported, and every install is compared with the official build of its version.
- Switching the anti-cheat off during a match: the match server re-checks every player about every 30 seconds with a one-time match code.
- Replayed or forged heartbeats: every heartbeat is signed and carries a single-use nonce and a sequence number.
- Ban evasion: a confirmed hardware ban, and owner review when a new account plays on the same PC (two or more hashed hardware parts) as a banned account.
- Aim assistance and wall hacks that hide from the PC checks: server-side statistics (snap-to-target, reaction times, following or pre-aiming hidden players, automated jumping), pooled across matches so a careful cheater still stands out.
What it cannot reliably catch (honestly)
- Cheats running in the Windows kernel or below it (drivers, hypervisors). A user-mode check can be hidden from by code with more privileges. Server statistics remain the backstop.
- Hardware cheats that read memory from a second device (DMA cards) or aim from a camera on another computer. These leave no trace on the PC; only gameplay statistics and human review can reveal them.
- A brand-new or private cheat that is not on the list yet and plays like a human. Lists are updated, and statistics improve as more matches are played.
- Account sharing or boosting by a different person on the same account, when the play looks human.
- Single matches: statistics need many kills and shots; one great game never opens a case on its own.
Trust boundaries
- The player's PC is not trusted. Anything the app reports can in principle be faked, so the server never relies on one report: it checks signatures, compares installs with the official build, and adds its own match-server statistics.
- The match server and the A.C.E site are trusted. Server-to-site calls are signed with a shared secret.
- The A.C.E site never trusts the browser for eligibility: queue and server admission are decided on the server.
How decisions are made
- Nothing bans automatically. A strong finding holds queue access and opens a case; statistics and other signals only decide what is reviewed first.
- A person (the owner) decides every case, optionally with advice from A.C.E Overwatch (veteran players who vote on anonymised evidence).
- Every decision is backed by a sealed evidence record (SHA-256), and every hold, ban or decision can be appealed on the appeal page.
Privacy limits we keep
- No screenshots, keystrokes, files, browsing data or full process lists are collected. Window titles never leave the PC; only the matched list entry is sent.
- Hardware identifiers are hashed on the PC and re-hashed with a secret key on the server; they are used only to enforce bans.
- Anti-cheat data is deleted after 90 days unless it belongs to an open case or a confirmed ban.
Reporting a weakness
- If you find a way around A.C.E Shield, or a security issue on A.C.E, email ace.platform.official@gmail.com with the steps. Please do not publish it or use it in matches before it is fixed. We will not take action against good-faith reports.