Account and security

How GramClaw protects your accounts and data, and good practices for keeping your workspace secure.

Your Telegram accounts are business assets, and connecting them to any platform deserves scrutiny. Here is how GramClaw handles security, and what remains in your hands.

The starting principle: GramClaw never has your Telegram password. Accounts are linked through a secure connection flow that you approve from your own device, producing a session — not a credential — and you can sever that session at any time by disconnecting the account.

How GramClaw protects you

  • No stored passwords: connections use an approved-session flow, never saved credentials.
  • Scoped API keys: every key is limited to the scopes you grant (read / send) and only to your workspace's accounts.
  • Keys shown once: the full gc_live_… key appears only at creation, so it cannot be casually re-read later.
  • Instant revocation: deleting a key or disconnecting an account takes effect immediately.
  • Individual team logins: teammates get their own accounts — collaboration never requires sharing a password.
  • Payments through Stripe: card details go to Stripe, not to GramClaw's servers.

Good practices on your side

  • Treat API keys like passwords: store them in a secrets manager, never in shared docs or code repositories.
  • Use read-only scopes wherever possible — most dashboards and reports never need send.
  • Create one key per integration so revoking one never breaks the others.
  • Revoke keys you no longer use, and rotate keys when someone with access leaves the team.
  • Only invite trusted teammates — a workspace shares its conversations by design.
  • Enable two-step verification inside Telegram itself; it protects the underlying accounts everywhere, not just here.

If something looks wrong

  1. 1

    Revoke exposed keys first

    Delete any suspect API key in Settings → API Keys — it stops working the moment it is deleted.

  2. 2

    Check connected sessions in Telegram

    In the Telegram app, review active sessions and terminate anything you do not recognize.

  3. 3

    Disconnect and reconnect the account

    Disconnecting in GramClaw severs the session; reconnect through the secure flow when things are clean.

  4. 4

    Review your workspace members

    Make sure everyone with access still should have it.

Frequently asked questions

Can I revoke access?
Yes — delete API keys from Settings, and disconnect Telegram accounts you no longer want linked. Both take effect immediately.
Does GramClaw see my Telegram password?
No. You approve the connection from your own device; GramClaw holds a revocable session, never your credentials.
What data does GramClaw store?
The chats and messages of connected accounts are synced into GramClaw's store so the inbox, search, and AI can work. Disconnecting an account stops that syncing.

Related articles

Chat on Telegram