The records are uploaded to a server along with the replay. The replays are just a series of timestamps and keyboard inputs which means I can verify that the records are legit.
