Security

Security is enforced on the server, not hidden by the interface.

Credentials stay server-side

Bot tokens and AI provider keys are encrypted at rest and are never sent to the browser. The admin panel only ever shows a masked value.

Every Telegram webhook request is verified with a secret token before anything is processed. Invalid attempts are logged as security events.

Every admin action is checked on the server, not just hidden in the interface. Sessions expire, and repeated failed logins are rate-limited.

One customer's conversation and data are never used to answer another customer — enforced at the data layer.

Admin actions and security events are logged separately, with no secret values ever written to logs.