Security by design
Security is not a page badge; it is enforced through passwords, tokens, tenant boundaries, audits, and credential handling.
Passwords use Argon2id hashing. Refresh tokens are stored only as hashes and continuously rotated; replay revokes the whole token family.
The user console derives the personal tenant from the authenticated identity and never trusts a tenant_id from the frontend. Every resource request verifies membership and permission.
Sessions are encrypted with an independent key. Administrators cannot view them in plaintext. Users can revoke authorization, and the platform does not provide bulk messaging, member invitations, or spam tools.
Disabling users, revoking sessions, and changing system settings write audit entries that ordinary users cannot modify. Sensitive fields are masked automatically.
After registration and verification, connect Telegram, choose bots, set a schedule, and review execution records.
Create an account