Security

Updated: 2026-07-26 Website: https://braidix.com Contact: Telegram @braidix, e-mail: braidix2026@gmail.com

We handle sensitive data — Telegram authorization sessions. For us, security is not a marketing section but part of the architecture. Here is what we actually do.

Encryption

• All traffic between you and the Service is transmitted over HTTPS (TLS).
• Telegram sessions and related secrets (including proxy credentials) are encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256).
• The encryption key is stored separately from the database — in the OS key store (keyring) or in an isolated server environment variable, never in the database itself. As a result, a database dump or a leaked backup does not by itself reveal sessions.
• Sessions are bound to your account and isolated from other users of the Service at the data-model level.

Authentication

• User passwords are stored only as bcrypt hashes with a per-user salt — the original password cannot be recovered from the database.
• Sign-in is supported via e-mail and password and via Google OAuth. Accounts created via OAuth only do not store a password at all.
• The web session is stored in a signed cookie containing only the user identifier; the profile itself is loaded from the database on request and is not serialized into the cookie.
• E-mail registration requires address verification.

Payments

We do not store or process bank card data. All payments go through third-party licensed providers (Stripe, lava.top) — card data never reaches our servers. We store only transactional metadata (amount, status, identifier, payment method).

Storage and access

• Servers are hosted in a data center located in the European Union (Finland, Helsinki; provider Hetzner).
• Access to production infrastructure is limited to a strictly restricted group.
• Database backups are created and stored in encrypted form (the key is derived from a password via PBKDF2-SHA256).

Monitoring and logging

We keep technical logs of API calls and errors to detect failures and anomalies. Logs never store session keys or other secrets in plaintext — only service identifiers (e.g. telegram_user_id and phone number).

⚠️ Note to self: if you later add Sentry / Prometheus / Grafana or other monitoring, you can expand this section. For now we list only what actually exists.

Recommendations for users

Any cloud service that works with Telegram sessions inevitably becomes a trusted party. We recommend that you: - use dedicated working accounts for automation rather than your personal Telegram; - enable 2FA on your accounts and store passwords in a password manager; - remove accounts you no longer use from the Service.

Report a vulnerability

Found a vulnerability? Contact us directly on Telegram @braidix or at braidix2026@gmail.com. We treat such reports as a priority and do not pursue researchers acting in good faith.