Unless it actually behaves like malware and attempts multiple workarounds to obtain root privileges that I should know about, it does run in userspace for me.

Perhaps later today I'll spin up the game and check lsmod, but if I'm wrong that's a massive black flag that has absolutely no chance of being legal no matter how many eula roofies they spiked my drinks with.

Done, no weird kernel module was loaded: unless nProtect is pulling a sneaky, it's running in user mode.