Lanka security

Where Lanka's data is stored, how it is protected, who has access to it and how to report a vulnerability. Last updated on 2 November 2026.

Data and encryption

Lanka runs on one Hetzner server in Helsinki (Finland, EU). The database and the job queues sit on the same server and have no port open to the outside. Bots' media and the database backups are kept in Cloudflare R2 storage. The full list of services is on the Subprocessors page.

All connections are HTTPS only. Bot tokens, bot secrets (the API keys for the AI step among them) and payment provider tokens are encrypted in the database with Active Record Encryption. Lanka's API keys and connected chats' tokens are stored as hashes. The rest of the data, visitors' messages included, is stored in the database without field-level encryption. The database is backed up daily, and each backup is encrypted with age on the server before it is uploaded. The key to the backups is kept away from the server.

Access

Only Lanka's administrators have access to the server and the database. The services' keys are kept in a password manager, not in the code. Sign-in, the API and the Mini Apps are rate limited per IP address.

Reporting a vulnerability

Write to support@lanka.bot: what you found, where, and how to reproduce it. We confirm that the message arrived and tell you what we do next.

This page is the consent to probe for vulnerabilities that section 4 of the Terms of use asks for, as long as you:

• test only on your own account and your own bots;
• do not read, change or delete other people's data;
• do not overload the service or send spam;
• report to us and publish no details until we fix the vulnerability.

We run no bug bounty programme.