Security & compliance
Built for credentials, money and regulated traffic
Messaging touches your users’ phone numbers, your telecom compliance and your balance. Every path is authenticated, scoped, encrypted where it matters and logged.
Accounts and access
Argon2id passwords
Passwords are hashed with Argon2id; SMS21 never stores or emails them.
Two-factor authentication
TOTP second factor for every user, mandatory for platform administrators.
Step-up for sensitive actions
Changing money, credentials or platform settings needs a fresh second factor.
Sessions you can end
Idle sessions expire, and “sign out everywhere” or a password change ends every session at once.
API keys
Stored as digests
Only a SHA-256 digest of each key is kept; a key is shown once when created.
Scoped per project
A key can only do what its scopes allow — send OTPs but not read reports, for example.
IP allow-lists
Restrict a live key to your servers’ addresses; requests from anywhere else are refused.
Rate limits
Per IP, per key and per project, with standard RateLimit headers.
Data protection
Credentials sealed to the sender
Provider and WhatsApp tokens are encrypted so only the sending service can open them — not even the API can read them back.
Encrypted secrets at rest
MFA secrets, gateway keys and one-time payloads are encrypted with AES-256-GCM.
OTP codes never stored
Codes are hashed; the plain code exists only in memory and on the handset.
Data retention
Message content is purged and numbers masked after the retention period.
Webhooks and the web
Signed webhooks
Every event is HMAC-SHA256 signed with a timestamp, so you can verify it and reject replays.
No private targets
Webhook and media URLs that resolve to private networks are refused.
Strict browser policy
Content-Security-Policy with per-request nonces, HSTS and no framing.
Audit log
Every administrative action — money, prices, access, settings — is recorded with who and when.
Compliance
Rules enforced by the platform, not by habit
DLT (India)
Live SMS is matched to your approved template, header and entity before it reaches an operator.
Opt-outs
STOP replies and your suppression list are respected by every sending API and campaign.
Ledger
Money moves only through an immutable, idempotent ledger with GST invoices.
Found a vulnerability?
Please tell us privately first. Include the steps to reproduce it; we reply to every report and fix confirmed issues promptly.
Start today
Build against the sandbox, go live when you are ready
Create an account and a test key in minutes. Nothing is delivered and nothing is charged until you switch to a live key.