What protects your account

Passwords are stored as salted hashes, never as text, and a sign-in attempt is rate limited per address and per account. Anyone on your team can turn on two-step sign-in with an authenticator app, with eight single-use recovery codes for a lost phone. Sessions last 30 days, and Settings shows how many devices are signed in and lets you sign out everywhere else with one click; changing your password does the same.

Each person has their own login with a role: owner, admin or member. Members cannot see billing or touch API keys, webhooks or the team. Changing a login email needs the current password and is announced to the old address, so a stolen session cannot take over an account on its own.

API keys are shown once when they are created and stored as a hash, so a copy of our database does not contain a usable key. Revoke a key and it stops working at once. Test keys cannot send a real text or spend credit, however they are used.

Every webhook delivery is signed with HMAC SHA-256 over a timestamp and the body, so your system can check that a call came from us and was not replayed. Webhook signing secrets are encrypted at rest with a key that lives only in the server environment. We refuse webhook URLs that point at private or internal addresses.

The dashboard, the API and the gateway link all run over HTTPS. Our Raspberry Pi gateways connect out to the server over an encrypted private network and never accept inbound connections; each one holds a token that staff can rotate from the admin area. The database is backed up every night, and the backups are kept on the server with access limited to the system account that writes them.

Phone numbers are stored in international form and shown masked in logs. We keep what the service needs to send texts, show history and bill you, and nothing is sold or shared for marketing. The privacy notice and the data processing agreement set out the detail, and the sub-processors page lists who else handles data for us.

Every new account is checked by a person before it can send, and sender names are checked against the MEF SenderID Protection Registry and for impersonation before they go live. The service texts UK mobile numbers only, so a stolen key cannot be used to blast numbers abroad. STOP and the other opt-out words are honoured automatically and opted-out numbers are refused at send time. Campaigns respect quiet hours.

Staff actions, account changes, role changes, key creation and credit adjustments are all written to an audit log with the person, the time and the address they came from. Credits move only through a ledger, so every penny of balance can be traced to a top-up, a send or a refund.