Privacy and security

Security architecture

The public site, authenticated application, documentation and administration interface run in one maintained Next.js application behind nginx. Processing workers, the existing Telegram bot and download services remain private internal services with narrow integration points.

Account protection

Passwords are hashed with Argon2id. Application sessions use high-entropy random tokens; only their SHA-256 hashes are stored. Production cookies are HttpOnly, Secure and SameSite. Google OAuth uses state and PKCE, while Telegram payloads are verified before identity linking.

Sensitive actions use recent authentication or a trusted-session rule. A new session cannot disconnect older devices or unlink Google during its first 24 hours, and Google cannot be removed until a password exists.

Administrative security

Administration uses role-based permissions, audit logging and step-up authentication. Password verification is followed by the configured second factor, such as TOTP or an administrator code delivered through the designated Telegram channel. Authorization is checked on every server action and route, not only in the interface.

Media and service isolation

Uploads are stored outside the application source tree and are not executed. File type, size, ownership and storage key are validated server-side. Private downloads use controlled routes rather than directory indexes.

Docker and VIP operations run through fixed allowlist wrappers. The web process cannot issue arbitrary shell or Docker commands. VIP writes use an expected record hash and preserve unknown igbinary fields.

Processing locations

Current production infrastructure is located in Germany (Frankfurt) and France (Paris). Service monitoring, backup rotation and incident procedures cover both locations.

Monitoring and logs

SwiftTool records authentication, security, permission, content, subscription and service-control events needed for operations and investigation. Logs avoid passwords, raw session tokens, OAuth secrets, Telegram bot tokens and complete raw VIP values.

Backups and recovery

Database and file backups use documented rotation, checksums and restore verification. Deployment uses a release directory and atomic switch so rollback does not overwrite the previous working release. Restores must reapply pending deletion and revocation state before a service is returned to users.

Your security controls

Use a unique password, review connected devices, keep at least one recovery sign-in method, disconnect sessions you no longer use and report unexpected account activity through Support. Data export and deletion controls are available from Profile.