Security
Connecting a messaging account to a panel takes trust. This page describes how we work, limits included.
MyCRM lets your team run its messaging accounts from one panel. To do that we hold a session that connects to your account on your behalf.
Telegram is the channel available today (personal numbers, groups, channels and bots). WhatsApp is in development (coming soon) and Instagram follows after it. This page describes today's Telegram connection.
A number is connected by scanning a QR code in the Telegram app, by phone number and login code, or by importing an existing session file. If the account has a two-step password, the person connecting it enters it once during setup; it is used for that login and not stored.
The connection appears as a separate session in Telegram's Devices list. Your phone stays logged in, and you can end the panel's session from there at any time without us.
| Data | Status |
|---|---|
| Account session key | Stored, encrypted with AES-256-GCM |
| Bot tokens | Stored, encrypted with AES-256-GCM |
| Telegram message history | Not copied; it is read live from Telegram when you open a chat |
| Last-message preview | Stored; one short preview per chat |
| CRM data | Stored: assignee, stage, labels, internal notes, custom fields, reminders |
| Statistics events | Stored: direction, time, chat and sending member of a message; no message text |
| Support tickets | Stored, including the quote of the message a ticket was created from |
| Content you prepare | Stored: message templates, bulk message texts and target lists |
| Panel passwords | Never stored as plain text; only a one-way hash (scrypt) is kept |
One limit: the encryption key lives on our server, because the server must decrypt the session key to stay connected for you. Encryption protects against the database being obtained on its own.
Every member signs in with their own email and password. The messaging account's password, login code and two-step password are never shared with the team, and members cannot see the session key. Roles are owner, admin and agent.
Each member can turn on two-factor authentication under Settings → Security. It is standard TOTP and works with Google Authenticator, Microsoft Authenticator or Authy. Once enabled, login asks for a 6-digit code after the password, and turning it off also requires a current code. After ten failed login attempts there is a 15-minute wait.
There is currently no setting that forces it for the whole team; each member enables it themselves, and switching it on or off is written to the audit log.
The owner and admins see who did what and when under Settings → Audit log. It records adding, editing, disabling and deleting members; changes to number access; removing a number; deleting messages; CSV exports; creating bulk sends; proxy imports and assignments; new webhooks; and switching two-factor authentication on or off.
Numbers connected without a proxy share our server's IP address. Give each number its own SOCKS5 proxy, or upload a list to the proxy pool, which spreads working addresses evenly and checks that they respond. A proxy does not guarantee against account restrictions; it only separates numbers at the network level.
What should I do when a team member leaves? Disable or delete the member and they can no longer sign in. They never knew the passwords of your messaging accounts, so there is nothing to change on the account side. Chats assigned to a deleted member become unassigned, and their notes stay on the chats.
How do I disconnect an account? Three options. Disconnect pauses the session and keeps the record. Remove deletes the number, its encrypted session key and the CRM records on its chats. Also log out additionally ends the device session on Telegram's side.
Can MyCRM staff enter my workspace? A platform administrator can sign in to a workspace for support. That sign-in is written to your audit log as "Platform administrator".
Is my data deleted when my subscription ends? No. When the paid period ends the panel becomes read-only; your data is not deleted.
Related: Team permissions · Shared inbox · CRM for crypto and Web3 teams · CRM for iGaming · Telegram product site · Start a trial