Security — what we hold and what we do not

There is no password

Not for you, not for the platform owner. Signing in is Telegram confirming it is you. There is nothing to guess, nothing to reuse from another site, and nothing to steal in a breach — because there is no password stored anywhere in TG Access.

It also means nobody can be phished into a lookalike login page: the Telegram button only works on this exact domain.

Your keys

Your bot token and your payment keys are encrypted the moment you save them. Afterwards the site can show you only enough to recognise which key is which — whether a Stripe key is live or test and its last four characters, the first and last characters of a wallet address. The key itself is never displayed again, never written to a log, and never put in a link.

Your money

It never reaches us. Subscribers pay into your own Stripe, PayPal or wallet. We could not hold, freeze or take a cut of your payouts, because they never pass through anything we control. Commission is invoiced for exactly this reason.

Your data, and everybody else's

Separation is enforced in the database itself, not by remembering to filter. Every table that belongs to a customer carries the customer's id in its keys, so a query that forgot to scope itself would fail rather than quietly return somebody else's rows.

On top of that, every page and every button is tested against a second customer's ids — the tests deliberately forge a request for another account's plan, payment and invoice and require a refusal and that the row did not change.

Invite links

Every invite is single-use and expires within a day. Forwarding one to a friend gets the friend nothing.

If you lose access

Your Telegram account is your account. If you lose the account itself, contact support — there is a recovery path, and it deliberately requires more than an email address.