Security Infrastructure

Last updated: July 3, 2026

Security is built into every layer of Raley.one. We apply best-in-class cryptographic systems to secure your workspace, API keys, and OTP flows.

1. OTP Hashing & Zero-Knowledge Storage

We never store raw OTP verification codes in plain text. Whenever a code is generated, we immediately compute its SHA-256 hash and save only the hash. In the highly unlikely event of a database compromise, your active verification codes remain completely unreadable.

2. Timing-Safe Code Validation

To prevent side-channel timing attacks, our OTP validation endpoint executes verification checks using Node's native constant-time comparison library (crypto.timingSafeEqual). This guarantees that the comparison time is identical whether the code is right or wrong, eliminating the risk of attackers guessing codes byte-by-byte.

3. Workspace Isolation

All user configuration data, connected Telegram bot tokens, API keys, and log records are isolated at the database level using granular Firebase Security Rules. Multi-tenant access is fully segregated — no workspace can ever query or modify data belonging to another workspace.

4. Encryption in Transit

All network traffic to and from the Raley.one API is encrypted using secure TLS 1.3 (Transport Layer Security) protocols. Plain HTTP requests are rejected immediately, protecting your API key from being intercepted on public networks.

5. Safe Token Storage

Your Telegram Bot API tokens are stored using strict server-side access controls. These tokens are only used to instantiate Telegram API HTTP requests and are never exposed via public APIs or client-side dashboard panels.