Frequently Asked Questions about Security

1. Is this a non-custodial wallet? If so, what is it?
Yes, this is a non-custodial wallet. That means: We do not have access to your funds. We cannot block, freeze, or restrict your access to your money. You are the sole owner of your private keys and seed phrase. We believe in financial freedom – your assets belong only to you.

2. How is my seed phrase stored? Do you save it?
Your seed phrase never leaves your device. We do not store it on our servers. The seed phrase is encrypted on the client side using AES‑256‑GCM (bank‑grade encryption) with a key derived from your PIN via PBKDF2 with 350,000 iterations. The encrypted seed phrase is stored in Telegram’s own cloud storage (TelegramStorage), which is officially part of the Telegram Bot API. Telegram only sees encrypted characters and numbers – even if your Telegram account is compromised, the seed phrase remains unreadable without your PIN. We have zero access to your seed phrase, and neither does anyone else.

3. How do you store data in Telegram?
We use double‑layer encryption: First layer: your data is encrypted with AES‑256‑GCM (bank‑grade standard) on the client before it is sent to Telegram. Second layer: Telegram itself encrypts all data with its own keys (at rest and in transit). Additionally, we apply: 350,000 PBKDF2 iterations – this dramatically slows down brute‑force attempts. Auto‑lock after 3 incorrect PIN attempts – this blocks offline dictionary attacks. So even if someone gains access to your Telegram cloud storage, the encrypted data is practically impossible to crack without your PIN.

4. How and what kind of data do you store on your servers?
We store only the minimum necessary data on our secure servers, and all of it is encrypted or anonymised: Encrypted Telegram ID – used for identification and notifications. Encrypted wallet addresses (TON) – used for balance queries and transaction history. Username hash (SHA‑256) – used for searching other users. Referral code – a public identifier for referral programs (not sensitive). Public wallet address – only if you choose to make a wallet public for receiving payments. All sensitive fields are stored in encrypted form using the same AES‑256‑GCM + HMAC scheme described above. We never store your PIN, private keys, or seed phrase on our servers.

5. Why do you need my data, how do you encrypt it, and how secure is it?
We need your data only for the wallet to function properly: Telegram ID – to authenticate you, link your wallet, and send you important notifications (e.g., transaction confirmations, swap statuses). Wallet addresses – to display your balances, transaction history, and enable transfers. Username – to allow other users to find you and send payments. How we encrypt it on the server: We use AES‑256‑GCM – symmetric encryption with authentication. The encryption key is derived from a master key using scrypt (a memory‑hard KDF). Every encrypted field is protected by an HMAC‑SHA256 signature to detect any tampering with the data.
Additionally, we insert random “marker” characters into the encrypted hex string as an extra layer of obfuscation (not cryptographic, but it adds complexity for automated analysis).

How secure is it?
AES‑256 is considered unbreakable with current technology – even quantum computers would take decades. Scrypt and PBKDF2 make brute‑forcing PINs or keys infeasible. All communication is over HTTPS with strict HSTS, CSP, and CORS policies. Your seed phrase and PIN never leave your device – they are only used locally. We follow industry best practices and continuously improve our security. Your data is safe with us.

We value freedom, we value you as our clients, we do everything to provide you with the best user experience, new technologies, and so on. If you have any problems, please contact our support team using a direct message in the channel - t.me/SociaWallet?direct.

Welcome to @SociaWallet | @Socia.