• 228 destinations
  • No KYC, ever
  • Bitcoin, Monero, USDT and 4 more
Sign in Start sending

Security

Security and data handling.
The safest identity file is the one that does not exist.

Scoped keys, signed webhooks, two-factor sign-in, encryption in transit and at rest, short retention. And nothing about who you are, because it was never collected.

Read the privacy policy Webhook signatures

01Controls

Six layers between your account and a bad day.

  • Account

    A password you choose and two-factor authentication with an authenticator app. Backup codes are issued once; keep them, because recovery runs through your email address only.

  • API keys

    Shown once, stored hashed, scoped to send or read, optionally bound to an IP allowlist, revocable instantly. Test keys validate and price without sending.

  • Webhooks

    Events signed with HMAC-SHA256 over timestamp and raw body in X-Meteor-Signature, HTTPS endpoints only, 6 attempts over 24 hours, secret rotation with a 24-hour overlap.

  • Transport and browser

    HTTPS everywhere with HSTS. A strict content security policy: no inline scripts, no third-party analytics or advertising code on the public site.

  • Idempotent writes

    An Idempotency-Key makes retries safe, so a network failure never turns into a duplicate send or a double charge.

  • Disclosure

    Incidents are posted on the status page while they happen. If an incident affects your data, the account address is notified without undue delay.

02Data

What is kept, for how long, and what is never collected.

Account
Email addressFor the life of the account, then 30 days
Messages
Numbers, content, delivery data90 days, then deleted
Deposits
Addresses, amounts, transaction idsAs long as accounting law requires
Technical logs
IP address, user agent, timestamps30 days, for security and abuse prevention
Never collected
Identity documents, company papersThere is no KYC file to breach or to hand over
Never collected
Payment card dataPayments are crypto deposits only
Never done
Profiling, selling data, ad trackingStated in the privacy policy
Your rights
Access, export, correction, deletionAnswered within 30 days

03Your side

Five habits that keep an integration safe.

  • One key per system, with the smallest scope, and an IP allowlist wherever the caller has fixed addresses.
  • Keys on the server only. Anything shipped in a browser or a mobile app is public.
  • Verify webhook signatures on the raw body, before parsing, and reject old timestamps.
  • Rate-limit anything that sends on a user's request, such as a code endpoint: per number, per IP and per account.
  • Turn on two-factor authentication and store the backup codes somewhere you will find them in a year.

Found a vulnerability? Write to [email protected]. The contact is also published in security.txt.

04Questions, answered

Security questions, answered.

How are API keys protected?

A key is shown once at creation and cannot be displayed again. Keys carry scopes (send, read), can be restricted to an IP allowlist and can be revoked instantly. Create one key per system so that a leak affects one integration only.

How do I know a webhook really comes from SMSMeteor?

Every event is signed: the X-Meteor-Signature header carries an HMAC-SHA256 of the timestamp and the raw body, computed with the secret of your endpoint. Recompute it, compare in constant time and reject timestamps older than five minutes.

Does the account support two-factor authentication?

Yes. Enable it in settings with an authenticator app and keep the backup codes: with no identity file on record, the email address and those codes are the only recovery paths.

What data do you hold about me?

The account email, your messages and their delivery data for 90 days, your deposit transactions, API key and endpoint configuration, and technical logs for 30 days. No identity documents, no payment card data.

Is message content used for anything else?

No. The privacy policy states that content is not used for advertising, profiling or training, and it is deleted after 90 days.

How do I report a vulnerability?

Write to [email protected] with the details and a way to reproduce. The contact is also published in /.well-known/security.txt. Please do not test against other customers' accounts or send traffic to numbers you do not own.

05More products

Everything else in the toolkit.

One account, one balance, one rate card. Every product below is included; none costs extra.

See the rate card

Browse use casesCompare providers