Security
This page describes how Telebux is built and operated, what protects your data, and where we are still maturing. We would rather be accurate than impressive, so it includes both.
1. Hosting and infrastructure
Telebux runs entirely on managed platforms. We operate no servers of our own, and there is no SSH access to production machines.
- The application and its PostgreSQL database are hosted on Railway.
- The website and web application are served by Netlify.
- All traffic is served over HTTPS. Data is encrypted in transit and at rest by our infrastructure providers.
2. Encryption
- All connections use TLS.
- The database is encrypted at rest by our database provider.
- Sensitive credentials, including third-party integration tokens such as Telegram sessions and Google and Slack tokens, are encrypted at the application layer with AES-256-GCM before they are written to the database, so they are protected independently of the database itself.
- Passwords are never stored. They are hashed with bcrypt.
3. Your messages
Telegram is different from most integrations, by design. Telebux acts as a Telegram client in your browser. Your conversation history is loaded directly from Telegram when you open a chat and is not stored in our database. What we keep is limited to the details you deliberately turn into CRM records.
Slack works differently because Slack's API requires a server. When you connect Slack, message content passes through our servers so it can be displayed to you. We connect using your own Slack account, we never add a bot to your channels, and messages you send are sent as you.
4. Access control
- Data is scoped per workspace. Records in one workspace are not visible to another.
- Workspace members have roles that determine what they may do.
- Optional two-factor authentication (TOTP) is available on every account.
- Sessions use signed tokens in HTTP-only, Secure, SameSite cookies, with CSRF protection on requests that change data.
- Every integration is connected by an individual user with their own account, and can be disconnected by them at any time.
5. Application security
- Rate limiting is applied to authentication and to the API.
- HTTP security headers are set on both the API and the website, including a strict Content-Security-Policy, HSTS, and clickjacking and MIME-sniffing protections.
- Input is validated on the server, and database access uses parameterised queries.
- Integrations request the narrowest permissions that make the feature work.
6. Development process
Source code is held in a private repository. Changes are made on branches and merged through pull requests. Continuous integration builds the application and runs the automated test suite on every change, and changes are not merged when it fails. Database changes are applied through versioned migrations. Deployment to production is automated.
7. Data retention and deletion
You can delete individual records at any time. Deleting a workspace removes its data, including associated records. Database backups are retained by our provider on their standard schedule and expire automatically. To request deletion of your account and data, contact us at the address below.
8. Sub-processors
We publish the third parties that may process data on our behalf. See our sub-processors page.
9. Keeping this page accurate
The statements on this page are specific on purpose, which means they can go out of date. We treat them as part of the product: when a change alters what we store, where we store it, or which third parties receive data, this page and our sub-processors page are updated as part of that same change rather than afterwards. If you believe something here no longer matches how the Service behaves, please tell us at the address below.
10. Reporting a security issue
If you believe you have found a vulnerability, please report it to dusanio@telebux.xyz and give us a reasonable opportunity to fix it before disclosing it publicly. We will acknowledge your report and keep you updated. We are grateful for reports made in good faith and will not pursue action against researchers who follow this process.