Security and data practices

GramClaw is a Next.js application hosted on Vercel. Authenticated server routes communicate with Supabase for application data, Unipile for Telegram connectivity, Stripe for billing, and OpenAI for optional AI features. Provider credentials and service-role keys are read by server-side code and are not intentionally sent to the browser.

• Authentication is handled by Supabase Auth through Google sign-in or an email magic link.
• Session tokens are stored in HTTP-only cookies. Production cookies are marked Secure and SameSite=Lax.
• Protected API routes verify the signed-in user. Workspace and Telegram-account operations apply server-side membership or allowed-account checks.
• Telegram accounts are connected through Unipile's hosted authorization flow. GramClaw does not ask users to enter or store their Telegram password.

The public application and outbound provider API calls use HTTPS, which protects data in transit. GramClaw does not configure disk-level encryption itself; database and file storage are managed by Supabase. This code review did not independently verify the live Supabase project's storage settings. GramClaw does not currently add separate application-layer encryption to individual database fields.

GramClaw stores account identity details, workspace membership, connected-account metadata, synchronized chat and message content, message metadata, campaign configuration and results, pipeline data, suppression records, billing references, and API-key metadata. Campaign files may be stored in a private Supabase Storage bucket. Inbox attachments are fetched through an authenticated proxy and may be held briefly in process memory for delivery performance.

AI features send the user's request and the conversation or contact context needed for that request to OpenAI. AI actions that write or send require an explicit confirmation in the product.

Current retention policy: GramClaw does not yet publish a fixed automatic deletion window. Disconnecting Telegram stops future access and synchronization but does not by itself delete data already synchronized into GramClaw. Contact us to request workspace or account-data deletion. We will verify ownership before acting.

Backups: GramClaw relies on its managed storage providers and does not currently publish a customer-facing backup-retention or restore-time commitment. Do not use GramClaw as the only archive of important conversations.

These services may process customer data according to the feature being used. Their own policies govern their infrastructure.

When a material incident is confirmed, GramClaw will identify the affected component, contain the issue, restore service, and publish plain-language updates on the status page. Public updates exclude customer identifiers, credentials, internal hostnames, and details that would make exploitation easier. Material incidents receive a resolved timestamp and a post-incident note when the facts are established.

GramClaw API keys are shown in full only when created. The database stores a SHA-256 hash and a short display prefix, not the reusable plaintext key. Keys can be scoped to read, write, and send operations and can be revoked from Settings. Keep keys out of browser code, URLs, screenshots, and source control.

Report a suspected vulnerability privately on Telegram to @mar_gramclaw. Include the affected surface, reproduction steps, and potential impact. Do not access other customers' data, disrupt service, or publish the issue before remediation.

We aim to acknowledge a valid report within three business days. This is an acknowledgment target, not a guaranteed remediation time.