Trust & architecture
Why you can trust it
Every architectural decision was driven by one question: how do we keep your Telegram safe and your data private?
Architecture
Your data stays on your VPS.
Each customer runs on their own VPS. Telegram session, messages, AI keys, all on your server. We can't read them.
Backups are zero-knowledge encrypted with a passphrase only you hold. We hold ciphertext only.
Your VPS
Telegram TOS
Telegram TOS: the honest answer
"Scraping prohibited"
The carve-out allows "ordinary use as a user." CRgraM operates through your own logged-in account, with channels blocked and groups capped, so its behavior stays close to ordinary use rather than mass scraping.
"Actions without consent"
Every send originates from your click. AI proposes, you dispose.
Group cap is hardcoded
Managed beta: ≤50 members. Channels always blocked. This limit is not user-configurable in the managed beta.
The full analysis (docs/TOSSAFETY.md) ships with the source, published at launch: github.com/muninnravenbot-ux
What we refuse
What we refuse to do
No central database of customer data.
No AI proxy. In the current design, your VPS calls the AI provider directly.
No group-size bypass. 100-member cap in source code.
No shared api_id. Each customer registers their own.
GDPR & DPA
GDPR: architecture built to support your compliance
You control your data; we act as your processor for the managed service.
Your Telegram messages, contact data, and AI keys live on your VPS. In normal operation we do not hold or access them. That positions you as the controller and the party able to handle data subject requests directly.
Right to erasure = one command
Delete your VPS and all data is gone. No "we'll process your request within 30 days", because there's nothing of yours on our end to process.
No cross-customer data sharing
Each VPS is isolated. No shared database, no analytics pipeline, no data lake. One customer's data never touches another's.
DPA available on request
For managed beta customers, we sign a Data Processing Agreement. It sets out what each side handles: your tenant database and Telegram session stay on your VPS, while the managed service is limited to updates, backup ciphertext, and support you request.
Questions
Security FAQ
Can you read my Telegram messages?
No. Your messages live in a SQLite database on your own VPS. We don't have SSH access to your server unless you explicitly grant it for support. The only copy that ever leaves the server is the backup, encrypted in the CRGBKUP1 format (AES-256-GCM) with a passphrase only you hold.
What happens to my AI API key?
It's stored on your VPS in a secrets file (mode 0600, only the system user can read it). Your VPS calls Z.AI or Anthropic directly. We never see the key, the prompt, or the response.
Can you read my encrypted backups?
No. Backups are encrypted in the CRGBKUP1 format (AES-256-GCM), using a passphrase you choose. We receive ciphertext blobs. Without your passphrase, the data is unrecoverable, by us, by law enforcement, by anyone.
What if my VPS gets hacked?
The attacker gets what's on that VPS, and only that VPS: per-tenant isolation means no other customer is exposed. Secrets are mode 0600 (readable only by the system user), and off-server backups use the CRGBKUP1 format (AES-256-GCM), useless without your passphrase. An attacker with root could read live data on that one server, so we recommend strong SSH key practices, fail2ban, and firewall rules (all documented in the setup guide).
Do you have access to my Telegram session?
The session file sits on your VPS, locked to the system user (mode 0600). During managed beta onboarding, we help you log in via QR code, the session stays on your server. We don't hold a copy. If you revoke the session from Telegram settings, CRgraM goes read-only until you re-auth.
Where are your servers located?
Your VPS is wherever you choose to host it. Managed beta customers get a dedicated VPS on Hetzner (Germany or Finland, EU jurisdiction, dedicated IP); US and Asia regions are available on Fly.io on request. We recommend choosing a region under your jurisdiction's data protection laws.
Is CRgraM GDPR-compliant?
The architecture is designed to support your GDPR compliance: you act as the data controller, your tenant database and Telegram session stay on your VPS, and in normal operation the managed service does not access them. Right to erasure is a single command (delete the VPS). We sign a DPA with managed beta customers, reviewed with legal counsel. Read the full GDPR section above →
What telemetry or analytics do you collect?
None from your VPS. The managed beta includes OTA updates, we push updates to your VPS as part of the managed service; your server doesn't report anything back. That's it. No usage tracking, no event logging, no "phone home".
Can I audit the source code?
Yes, CRgraM is AGPL-3.0, and the full source is published at launch. Every line (session handling, AI calls, backups, the updater) lands at github.com/muninnravenbot-ux.