Controls within the service.
Protected web access
The application uses HTTPS redirects and secure sign-in cookies. Passwords are hashed. Keep credentials private and use the approved HTTPS address supplied for your account.
Account-scoped permissions
Authenticated users and API keys are checked against account access and permissions. Customer media is served through authorised routes, not a public document directory.
API credentials and events
API keys have permissions and can expire or be revoked. Webhook events support signature verification so an integration can check the event before processing it.
Activity records
Message histories record progress and available failure information. Administrative changes have audit records, and operational monitoring can surface sending problems for investigation.
A main account administrator can administer its subaccounts, including their message records. Subaccount separation does not hide that information from the parent administrator. Plan account ownership and user access accordingly.
These controls do not make MMS end-to-end encrypted and do not certify blanket legal compliance. The mobile delivery path and a recipient's saved copies are outside the protection of the website's sign-in.
Retention needs a defined purpose.
The service includes configurable cleanup of stored message attachments. Attachment cleanup is separate from message text, status history, financial records and audit records; it does not delete every record of a communication.
Keep authoritative source documents in your own document system. Before putting personal information into a workflow, confirm the agreed retention and deletion arrangements, applicable records obligations and any backup handling with the service operator. No fixed all-data deletion period or permanent archive is promised on this page.
Before sending a personal document.
- Check the recipient. Confirm that the number is current, belongs to the intended person and is appropriate for this communication. Consider shared phones and reassigned numbers.
- Minimise the content. Include only what the person needs. Avoid unnecessary identity numbers, banking detail or sensitive health and personal information.
- Consider visibility. Images may be saved, forwarded or shown on a shared device. A phone notification may reveal part of a message.
- Preserve the original. An image is not a searchable document or a substitute for an original signed file. Use an authenticated document channel when the information calls for one.
- Keep the lawful purpose clear. A requested service communication does not automatically permit subsequent advertising. Check the obligations that apply to your business and recipients.
Report a concern with the minimum necessary detail.
Use the contact form for a privacy question, suspected misuse or a security concern. Give a brief description and, if relevant, a message ID and approximate time. Do not paste passwords, API keys or customer documents into the form. Ask for an appropriate confidential exchange before sharing sensitive evidence.
If a message appears fraudulent, verify the business through a contact channel you already trust. Do not rely only on the name or payment details inside the message.
Read the applicable Privacy information, Terms and Acceptable Use information before entering into a service arrangement.