Customer texts stored encrypted
Everything customers write is kept encrypted in the database; a copy of the data file or of the whole disk shows none of it. Freed space is zeroed so no readable copy is left behind.
- Covers: messages, comments, voice-note texts, form answers, notes, ticket texts, drafts, task notes, the AI's working notes, messages as they arrived, and waiting jobs
Admin panel only on this computer
The admin panel cannot be reached from the internet and opens only on this computer; a web page that disguises itself as the panel's address gets no answer.
Password login for the panel
Once the owner account is made, opening the panel needs a password. It is at least 10 characters and stored in a form that cannot be read back even from the database.
- Before an account exists, the panel opens only in the app's own window on this computer
- Changes are accepted only from the panel itself; another web page cannot act with your sign-in
Lock after wrong tries
After 5 wrong passwords the account locks for 15 minutes. Sign-in from the app's own window has a lane of its own, so a nuisance program cannot keep the owner locked out.
- Also: 20 failures for one username from one device in 10 minutes lock that username on that device
Signed-in devices and sign-out everywhere
The Security page shows everywhere your account is signed in; sign one out or all the others at once. Changing the password signs the other devices out automatically.
- A sign-in ends after 12 hours idle and after 7 days at most
Two-step login
Besides the password, a 6-digit code from an authenticator app on the phone is asked; even a leaked password then lets no one in. Each code works once and turning it off needs the password.
- Works with any authenticator app (Google Authenticator, Microsoft Authenticator…)
- Set up by typing the setup key or copying the link
Reset a forgotten password
A forgotten password is reset only on this computer and only with the recovery code; there the lock can also be lifted or two-step login switched off. Every try is logged.
- Done with the password-reset tool in the app's folder
- 3 wrong codes end the run; 6 within 30 minutes lock the tool for 30 minutes
Key vault
Instagram, Telegram and WhatsApp connection keys, AI keys and payment-gateway keys are stored encrypted. The master key lives outside the database, locked to your Windows user by Windows' own protection; a copy of the data folder alone cannot open it.
- AES-256 encryption with a separate key for each use
- If Windows' protection fails, the panel warns that the key is only protected by file permissions and tries again at the next start
Advanced payments
Guard when the master key goes missing
If the master key file goes missing, the app never makes a new key silently: a red bar in the panel, an alert on the team's Telegram when possible, and backups pause. The key comes back with the recovery code, or a new one is made knowingly by typing NEW.
- 5 wrong recovery codes mean a 15-minute wait
Recovery code for a bad day
A code of 8 groups of 4 characters is made: the only way to open the backups on another computer. It is shown until you type it once to confirm; it can be printed or copied, and a new code can be made any time.
- After confirmation it is never shown again
- A new code opens future backups; older backups still need the old one
Detects changed program files
The program files are compared with the publisher's signed list at start and every 30 minutes. If something was changed or added, sending stops and a red bar stays in the panel until the original files are back; data is kept.
- Only signed parts of the app and the panel are loaded
- Panel pages are checked before they reach the browser
Only signed channel messages accepted
Instagram, WhatsApp and Telegram messages are accepted only with a valid signature, so a forged message never gets in.
Access log: who did what
Every view of a personal photo or file, every backup, deletion, sign-in, key change and settings change is recorded with the account that did it, and shown on the Settings page.
- About 95 kinds of action, each with a plain label
- Also: phone paired or disconnected, licence activated, customer data erased, Meta deletion requests
Security at a glance
The Security page shows how many of the main steps are done and whether each protection is on: keys, recovery code, encrypted backups, password login and the rest.
Sensitive steps only in the app's window
Until the owner account exists, showing the recovery code, list exports, the backup key and creating the first account work only in the app's own window; no other program on the computer can reach them.
- A browser opened by the app gets a one-time code valid for one minute, never the secret itself
- A new secret at every start
Signed requests to Instagram
Every request to Instagram is signed with the app's secret, so a stolen connection key alone is useless. If Meta refuses it, the app keeps working and says so on the Security page.
- On by default; it can be switched on again from the Security page
Safe public pages
Forms, payment pages and the customer portal send the browser safety rules, and secret links never leak to other sites. A file a customer sends opens in the page only if it is a plain picture or sound; anything else is just downloaded.