How data is protected
The service runs on Amazon Web Services in the United States (us-east-1). Its database sits on a private network and is not reachable from the internet.
Message content, provider identifiers and attachment records are encrypted at the application layer before they are stored. API keys and secrets are never written to message logs.
Inbound attachments are kept for up to 30 days.
Who can reach what
Everything belongs to an organization, and everything inside it to a project. Projects are isolated from one another: access to one organization or project never grants access to another.
API keys are scoped to a single project. Each key reaches only the lines it is allowed, holds only the permissions granted to it (none by default), expires after 7, 30 or 90 days and can be revoked at any time. Granting a permission never activates a line by itself.
People sign in to the Console through Amazon Cognito. Owners and administrators manage the organization’s members and their roles, and membership changes are recorded in an audit log. Each project also keeps a record of its own activity.
Webhooks
Events are delivered to the endpoints a project configures and signed under the Standard Webhooks scheme: an HMAC-SHA256 signature over the event id, timestamp and raw body. The signing secret is shown once when a subscription is created. During a rotation every event carries one signature per active secret, so endpoints can switch without downtime.
The people your agent talks to
Lines do not message strangers: a conversation starts when a person writes. When someone replies STOP, every send to them from that project is refused until they write again. Retried requests with the same idempotency key never send a message twice.
This website
messages.org sets no cookies and loads no analytics or advertising scripts. Its pages carry a strict Content-Security-Policy, cannot be framed and are served only over HTTPS. The Privacy Policy explains how fonts are loaded.
Report a vulnerability
If you believe you have found a security problem, use our contact form with the topic Security. Describe what you found and how to reproduce it, and leave out passwords, API keys and other people’s data. Please give us a reasonable chance to fix the problem before you share it.
Security researchers can also find this contact in security.txt.