Security

• Passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text, and must be at least 10 characters long.
• Session cookies are HttpOnly and SameSite=Lax, and marked Secure in production.
• Sign-in, sign-up and password-reset requests are rate-limited per IP address and email.
• Changing or resetting your password ends your other sessions, including “Remember me” cookies.
• Every change made while signed in must come from Dripl’s own pages: we check the Origin and Fetch-Metadata headers.

• Each connected account’s session is a separate file on our server that only the Dripl app can read.
• Session files and Telegram API keys are never returned by our API or shown in the dashboard.
• Removing an account logs its session out on Telegram’s side and deletes the session file.
• Each account has its own pace (daily and hourly caps, a minimum gap between messages and random jitter), so sending is spread out instead of bursting.
• Each account can use its own SOCKS5, SOCKS4, HTTP or MTProxy proxy. Proxy passwords and secrets are never returned by the API.

• Card payments run on Stripe’s hosted Checkout, so card numbers never reach our servers. Billing shows only the card brand, the last four digits and the expiry date, which we read from Stripe.
• Crypto payments run through DePay, and we verify the signature on every payment notification.

• When error monitoring is switched on, errors go to Sentry without cookies or authorization headers. Errors from our servers carry your user ID, so we can find what went wrong.
• Screen replays are recorded only around an error on signed-in pages, never for whole visits. The public pages load no monitoring code.

• Profile, password, team and billing changes go into an audit log that workspace owners and admins can view and export as JSON or CSV.
• Sent messages and forwarding logs are deleted automatically after 90 days, and audit entries after 12 months.
• The app runs in containers as a non-root user.

To delete your account and its data, email us from the address you sign in with. We act on requests within one month, as the GDPR requires.

The privacy policy lists what we collect, who processes it and how long we keep it.