OpenClaw Security Best Practices

Your AI assistant has access to sensitive information. Here's how to keep it secure.

1. API Key Management

Never Share API Keys

Your AI provider API keys are the most sensitive credentials. Never:

Share them in screenshots

Commit them to Git

Send them over email

Rotate Regularly

Change your API keys every 90 days:

Generate new key in provider dashboard

Update in MyOpenClaw settings

Revoke old key

Use Provider-Specific Keys

Create separate API keys for OpenClaw. If compromised, you can revoke without affecting other services.

2. WhatsApp Security

Linked Device Review

Regularly check WhatsApp → Settings → Linked Devices:

Remove devices you don't recognize

Note: OpenClaw appears as "Windows" or "Web"

Two-Factor Authentication

Enable 2FA on your WhatsApp account for additional protection.

3. Data Encryption

At Rest

MyOpenClaw.cloud encrypts all sensitive data at rest:

API keys: AES-256-GCM encryption

Gateway tokens: Individual encryption per user

Keyring passwords: Unique per instance

In Transit

All communication uses TLS 1.3:

Dashboard to control plane

Control plane to Fly.io instances

Instances to AI providers

4. Access Control

Strong Passwords

Your OpenClaw setup password should be:

At least 12 characters

Mix of letters, numbers, symbols

Unique (not reused)

Session Management

Log out of unused sessions:

Dashboard sessions timeout after 24 hours

Gateway tokens can be regenerated

5. Instance Isolation

Each MyOpenClaw instance is:

Separate Fly.io machine

Individual volume storage

Isolated network namespace

No shared resources with other users

6. Update Promptly

Security updates are released regularly. On MyOpenClaw.cloud:

You'll see an "Update Available" notification

Click "Restart" to apply updates

Takes ~30 seconds, no data loss

7. Monitor for Suspicious Activity

Watch for:

Messages you didn't send

API usage spikes

Unfamiliar integrations connected

8. Backup Your Data

While we maintain backups, you should:

Export important conversations periodically

Document custom skills and configurations

Keep API key copies in a password manager

Reporting Security Issues

Found a vulnerability? Email security@myopenclaw.cloud

We take security seriously and respond within 24 hours.

---

Secure your AI assistant today →