Security & data

Deplao runs and stores its data right on your computer. The cloud, the Public API and employee connections are all optional and only work once you turn them on yourself.

#Data & login sessions

• Stored on your computer: messages, contacts, CRM data, settings and photos / videos / files all live in the data folder on your machine (see the path under Settings → Storage (Cài đặt → Lưu trữ)).
• No Deplao server in between: the app connects straight from your computer to Zalo, Facebook and Telegram (through a proxy if you've assigned one); message content and contacts are not sent to Deplao's servers.
• Account passwords aren't stored: Zalo signs in with a QR code / cookie; Facebook and Telegram passwords are only used while signing in. The app only keeps the login sessions (cookies, tokens) on this computer, encrypted with your operating system's security mechanism (Zalo and Telegram sessions, bot tokens, Facebook cookies): if you copy the data folder to another computer or another Windows user account, you'll have to sign in again.
• Employee machines don't hold the original data: data is fetched from the Boss machine over the connection; employee machines only keep a photo / video / file cache (the oldest files are deleted automatically above 2 GB).
• Auto-deleted Zalo messages: when a conversation has "Auto-delete messages" turned on, Zalo deletes the messages on Zalo devices, but Deplao keeps the copy saved on your computer (and in your backup, if you have one).

#App screen lock

Set a password so nobody else can open Deplao on your computer.

1. Turn it on: Settings → Security (Cài đặt → Bảo mật) → set a password (at least 4 characters), enter it again → Turn on screen lock (Bật khoá màn hình). From then on, the app asks for the password whenever it opens.
2. Save the Recovery Key: the app generates a recovery code (Recovery Key), keep it somewhere safe. You can view it again at any time on the Recovery tab (password required).
3. Quick lock: click the padlock icon on the top bar or press Ctrl+Shift+L.
4. Forgot the password: on the lock screen, click Forgot password? (Quên mật khẩu?) → enter the Recovery Key → set a new password.
5. Change or turn off: the Change password (Đổi MK) tab changes the password; the Turn off lock (Tắt khoá) tab (password required) turns the screen lock off.

#Employees, Public API & apps: access only to what's granted

• Employees only see and work with the accounts assigned to them, within each module's permissions (Settings → Employees (Cài đặt → Nhân viên); see Employees & Workspaces).
• Instant revocation: disabling, deleting or changing the password of an employee ends that person's login session. If you suspect an account has leaked: click Sign out all employees (Đăng xuất tất cả nhân viên; Settings → Employees), every employee machine must sign in again.
• The Public API is off by default: it only works once you turn on the server under Tools → Apps, API & Webhooks → API (Công cụ → Ứng dụng, API & Webhook → API) and create an API key yourself. Each key is limited by permissions, allowed accounts, allowed IPs and expiry; a key is shown only once when it's created, and there's a Revoke all API keys (Thu hồi tất cả API key) button. See Apps, API & Webhooks.
• The "admin" permission of an API key includes every other permission (including managing employees and settings): only grant it to systems you trust completely.
• Apps (plugins): you review the list of permissions before installing; an app can only call the operations you approved, on the accounts you granted.

#The cloud is optional

By default all data stays on your computer. Settings → Internet & Cloud (Cài đặt → Internet & Đám mây; only on the host machine, not on employee machines) only does anything once you connect it yourself: see Internet & Cloud.

• Your own accounts: Cloudflare (fixed Internet address, R2 storage) or Google Drive. Deplao only creates tunnels, subdomains and buckets named deplao-… and never touches your existing data on Cloudflare; the Cloudflare token is stored encrypted on your computer.
• Google Drive: you sign in to Google in your browser; Deplao can only see files it created itself in your Drive (the "Deplao" folder).
• Data backups are encrypted on your computer with your Backup password (Mật khẩu sao lưu) before upload. If you forget this password, no other machine can open the backup: write it down carefully.
• Photos, videos and files synced along with it are uploaded to your store as original files (not encrypted): protect your Cloudflare / Google account with a strong password and two-factor authentication.

#Data folder, disk space & workspaces

• Change the folder: Settings → Storage → Choose another folder (Chọn thư mục khác) → pick a folder on drive D, E… or an external drive. The data (including photos, videos and files) is copied over and takes effect immediately, with no restart needed. Don't close the app while it's copying.
• A folder that already has Deplao data: choose Use the existing data here (Dùng dữ liệu cũ tại đây; switches to that data, and your current data stays where it was) or Copy current data here (Sao chép dữ liệu hiện tại vào đây; overwrites the old data there, cannot be undone).
• Check it: the Storage page shows the Config folder (Thư mục cấu hình) and DB file in use (File DB đang dùng). If it reports Folder mismatch detected (Phát hiện không khớp thư mục; common after a reinstall), click Choose another folder and point it back to your old folder to recover your data. Reset to default (Đặt lại mặc định) goes back to the original folder.
• Reduce disk usage: turn on Auto-delete media (Tự động xoá media) for each account (Settings → Accounts (Cài đặt → Tài khoản), on the Auto-delete media line right under each account; deletes files older than the number of days you set, running every day at 3:00), or store media on Cloudflare R2 / Google Drive and choose to free up local disk space.
• Workspaces: each workspace (Settings → Workspace, up to 5) has its own data, accounts and settings, Local for the Boss machine / working alone, Remote for employees connecting to a Boss machine. Deleting a Local workspace permanently deletes its data.

#Recommendations

• Keep the data folder on a separate drive and back it up regularly: turn on Data sync to the cloud, or quit the app completely (right-click the Deplao icon in the system tray → Quit completely (Thoát hoàn toàn)) and copy the whole data folder to an external drive.
• Don't share the data folder or the data file (.db) with anyone: it contains your messages, contacts and the login sessions of your accounts.
• Turn on the screen lock if the computer is shared; keep API keys, employee passwords and the Backup password private.
• No longer using an account: Settings → Accounts → Delete (Xóa) → choose Delete account only (Chỉ xoá tài khoản; keeps its data on your computer) or Delete all data (Xoá tất cả dữ liệu; permanently deletes that account's messages, contacts, CRM data and media).
• Deplao is a tool for managing your own accounts: follow the terms of Zalo, Facebook and Telegram and personal-data protection rules; don't use it to send spam or collect data unlawfully. For the full usage policy, see the Terms.