Last updated 27 October 2026.
1. Our approach
We handle identity documents, phone numbers, messages and payment records, so security is part of how we build and run the service. This page describes the controls we use. It is not a certification and does not promise that nothing can go wrong. We improve our controls over time.
2. Protecting data
- Encryption in transit: the website and dashboard are served over HTTPS, and browsers are told to use HTTPS only.
- Secrets: provider credentials and two-step sign-in secrets are stored encrypted in our database.
- Passwords: stored only as salted, slow, one-way hashes, never in readable form.
- Payment details: card and other payment details are handled by our payment providers, and we do not store full card numbers.
- Data separation: each customer's Numbers, messages, invoices and tickets are only visible to that customer and to authorised staff.
3. Protecting accounts
- Sign-in limits: repeated failed attempts are slowed down and can lock an account for a short time.
- Two-step sign-in: required for staff and available to every customer, using an authenticator app.
- Session control: you can see your active sessions and sign out other devices, and changing your password signs out the others.
- Email confirmation: new accounts confirm their email before they can order.
- Bot and abuse defences: signed form tokens, hidden-field checks, rate limits, a blocklist and optional challenge checks make automated sign-ups and card testing harder.
4. Protecting payments
Payment confirmations from our providers are verified with cryptographic signatures and checked against the provider before money is credited. Each ledger entry and payment carries a unique key, so a repeated message cannot credit or charge twice. Repeated payment failures from one account or connection pause payments and flag the account for review.
5. Protecting the network
We block texts and forwarding to premium-rate and other high-risk number ranges to prevent toll fraud. We validate destination numbers and limit message speed. Provider webhooks are verified and rate limited.
6. Staff access and accountability
Only staff who need access can see customer data, and admin areas need two-step sign-in. Important actions, such as payments, wallet changes, account status changes and policy changes, are written to an audit log with who did them and when.
7. Monitoring and incident response
We monitor for abuse and unusual activity. If we find a security incident that affects personal data, we act quickly to contain it, investigate and fix the cause, and tell the people and authorities that we are required to tell, including the Information Commissioner's Office within 72 hours where the law requires.
8. Your part
- Use a long, unique password and turn on two-step sign-in.
- Do not share your sign-in details, and sign out on shared devices.
- Keep the email address on your account secure, because it can reset your password.
- Tell us at once if you think your account is at risk.
9. Reporting a vulnerability
If you find a security problem, email [email protected] with the details. Please give us a reasonable time to fix it before you share it. Please do not access other people's data, disrupt the service or run automated scans at scale. We will acknowledge your report and keep you updated. We do not take legal action against good-faith research that follows these rules.