SMS API Security & Compliance Terms

This document outlines the security controls, compliance expectations, and operational protocols for transactional SMS services used by ASR Portal for user authentication, registration, and account security. By using portal features that send verification messages through our Vonage SMS API infrastructure, users and administrators must follow these security baselines to protect system integrity and user data privacy.

Scope of Permitted Messaging

The SMS API gateway is reserved for transaction-based operations only. Permitted use cases include:

User registration messages, including initial activation links or verification tokens used to verify mobile identity during sign-up.
Secure login messages, including temporary one-time passwords, two-factor authentication codes, and multi-factor authentication strings.
Account security alerts, including notifications related to password changes, unrecognized login attempts, profile updates, or similar account-protection events.

Marketing campaigns, unprompted promotional text messages, and unsolicited broadcasts are prohibited through this transactional SMS endpoint.

Data Encryption and Transport Security

All transactional API requests must use secure HTTPS endpoints protected by Transport Layer Security (TLS 1.2 or higher).
Sensitive login codes, one-time passwords, and temporary credentials must not be logged or exposed in plain text in external application traces, browser-accessible variables, screenshots, or client-side debugging output.
SMS verification data should be retained only for the limited time needed to complete authentication, security review, audit, or legal obligations.

API Key Management and Access Control

Vonage API keys, API secrets, signature secrets, and related credentials are sensitive system secrets and must be stored in environment variables or a dedicated secrets management system.
SMS API credentials must not be committed to source control, embedded in client-side code, shared in screenshots, or disclosed through support tickets or logs.
Where supported, API request traffic should be restricted to known application server IP addresses or approved network paths.
Delivery receipts and inbound webhook notifications should be validated with signed MD5, SHA-256, or stronger signature validation methods supported by the SMS provider to confirm authenticity and detect tampering.
Access to SMS credentials and configuration should be limited to authorized administrators with a business need.

Fraud Prevention and Rate Limiting

Registration, password reset, login, and verification-code screens must use application-level throttles to limit repeated SMS requests.
IP-based rate limiting, account-based attempt limits, phone-number velocity checks, and CAPTCHA controls may be used to reduce SMS pumping, automated abuse, and rapid-fire submissions.
SMS authentication codes should expire after a short hard ceiling, generally within 3 to 5 minutes, and expired codes must be rejected.
Repeated failed verification attempts may trigger cooldowns, additional verification steps, account review, or temporary blocking.

Compliance and Data Privacy

Messaging activity must comply with applicable telecommunications privacy standards, cellular carrier frameworks, and regional laws such as GDPR, CCPA, TCPA, or similar rules where they apply. Phone numbers collected solely for two-factor authentication, registration verification, or account security must not be shared, sold, or repurposed for secondary marketing paths.

SMS opt-in records, verification metadata, and account-security messages should be handled according to the Privacy Policy and retained only as needed for security, operational, audit, compliance, or legal purposes.

Reporting Security Issues

Security concerns, suspected SMS abuse, credential exposure, or suspicious authentication behavior can be reported to hello@example.com.