Skip to content

Security at SMSKit

Your message content is sensitive. Here's how we treat it.

Data handling

  • PII-masked logging. Phone numbers and message content are masked in our structured logs.
  • Minimal retention. Job history retention follows your plan; you control how long data lives.

Access & keys

  • Hashed API keys. Keys are stored as SHA-256 hashes, shown once, and independently rotatable (Key 1 and Key 2) for zero-downtime rotation.
  • Passwordless login for the dashboard (email one-time code); recovery phone verified via Twilio Verify.
  • Account-scoped everything. Every key, session, and device resolves to one account before any data is read, so there is no cross-account access.

Hardening

  • CSRF protection and security headers on the dashboard.
  • Rate limiting per API key and IP.
  • Health checks and Prometheus metrics so issues surface fast.

Access to your data is checked on every request.