Security

Who can reach what, and what is never shown.

Passwords are never stored in the clear.
Payment, SMS, PBX and bot keys are never returned: the screen only shows a «saved» flag.
A manager cannot leave their branch — including through the address bar.
Sign-in attempts are limited: several wrong passwords in a row block the account temporarily.
Every significant action is written to the log.

⚠The biggest risk is a shared account. If three people work under one «owner» login, the log, the branch boundaries and the permissions all stop meaning anything.

The map key is the exception: it is handed to the browser and cannot be a secret. Its protection is the domain restriction in the provider's dashboard.