Skip to main content
TOLQAR
Start Your Project
Platform Security

Security built into every layer

From signing in to confirming a payment to storing your files, every step on the TOLQAR platform is protected by controls that run today, under continuous monitoring.

Report a vulnerabilityPlatform status
Loading status…Last updated: November 3, 2026
  • Two-factor auth

    Available to every account, mandatory for TOLQAR staff

  • Encrypted traffic

    HTTPS everywhere with HSTS

  • Verified payments

    Payment events checked by digital signature

  • Backups

    Point-in-time recovery

Layers of protection

Six layers working together

Your account, payments, files and the platform itself each have their own protection.

Account protection

Signing in is the first line of defense, so we hardened it.

  • Passwords are stored hashed with bcrypt at a high cost factor. We cannot read them.
  • Two-factor authentication (TOTP) works with Google Authenticator, Microsoft Authenticator and Authy, with single-use backup codes.
  • 2FA is mandatory for every TOLQAR staff member before they can reach the admin panel.
  • Rate limits on sign-in and password-reset requests slow down automated guessing.
  • Email verification, and password re-entry for sensitive actions such as withdrawals.
  • Social sign-in with Google, Microsoft, GitHub and Telegram. Telegram's signature is verified before login is accepted.

Payments

Your card details never pass through our servers.

  • Payment happens on the provider's own pages (PayPal and crypto gateways). We do not store card numbers.
  • Every payment notification from a provider has its digital signature verified before we trust it, so a fake "paid" message cannot be forged.
  • Payment confirmation is atomic: if two notifications arrive for the same order at once, only one is applied, so delivery and commissions are never duplicated.
  • Payment errors reach us instantly as monitoring alerts so we can act quickly.
  • Local wallet payments are reviewed manually by our team before the order is confirmed.

Your files and products

Private files open only for their owner.

  • Download links for what you bought are signed and time-limited. They cannot be altered and they expire, so they are useless for permanent sharing.
  • Payment proofs, resumes and order attachments are served through signed links tied to their owner, not through direct storage URLs.
  • Images from outside the platform are accepted only from an allow-list of sources.

Platform hardening

The browser and the server run under strict rules.

  • Full security headers: HSTS, a CSP that limits scripts and frames to an approved list, clickjacking protection, and nosniff.
  • Sensitive browser permissions (camera, microphone, location) are disabled because the site does not need them.
  • A staging environment with a separate database, so we never test on customer data.
  • Continuous automated checks and dependency updates when security patches ship.

Backups and continuity

We plan for the day something goes wrong.

  • Database backups with point-in-time recovery, and we have tested a real restore.
  • A public platform status page shows live service health and incident history.
  • Technical error monitoring through Sentry so we spot problems before you do.

Transparency and accountability

Every sensitive admin action leaves a trace.

  • An audit log records administrative actions: who did what, and when.
  • Admin permissions are split by role. Not every staff member can do everything.
  • A standard security.txt file tells researchers where to reach our security contact.
Your data

How we handle your data

We do not sell your personal data. We collect only what is needed to run your account and orders, and we enable Google Analytics only with your consent.

Shared responsibility

How to protect your account

The strongest protection combines what we do with what you do.

  1. 1

    Turn on two-factor auth

    Do it from the Security Center in your account. Keep the backup codes somewhere safe, away from your device.

  2. 2

    Use a unique password

    Never reuse a password from another site. A password manager makes this easy.

  3. 3

    Check the link before paying

    Pay only from pages you opened inside tolqar.com, or from the provider's official page itself.

  4. 4

    Never share codes

    TOLQAR staff will never ask for your password, verification code or backup codes, in chat or by email.

Open your Security Center
Responsible disclosure

Found a vulnerability? Tell us

Security researchers are welcome. Responsible reports help us protect every user.

  1. 1

    Send your report

    Reproduction steps and expected impact, to the security email.

  2. 2

    We reply

    Within 72 business hours.

  3. 3

    We fix it

    We patch and verify the fix before any announcement.

  4. 4

    Responsible disclosure

    Only after the fix, coordinated with us.

In scope

  • The website and API endpoints
  • The admin panel
  • Payment flows and webhooks
  • The partner system

Out of scope

  • Denial-of-service (DoS) attacks
  • Social engineering
  • Any testing that touches real customer data
Security emailsecurity@tolqar.com
Report a vulnerabilitysecurity.txt
FAQ

Security questions

Account

It is optional for customers and we recommend turning it on. It is mandatory for every TOLQAR staff member before they can reach the admin panel.

Use one of the backup codes you saved when you enabled it. If you no longer have them, contact us through the contact page and we will help you prove ownership of the account.

Payments

No. Payment happens on the provider's own pages and card numbers are never stored on our servers.

Start payment only from inside tolqar.com, and check the domain name and the HTTPS lock. We will never ask you to pay through a private message or an unknown link.

Data

We do not sell your personal data. Full details are in our Privacy Policy.

Reporting

Email security@tolqar.com. For scams, attach the message or link exactly as you received it.

A security question?

Our team answers security enquiries directly.

Contact us