Security & data

How we protect your account, your keys and your customers.

Plain answers about what SMSHub stores, how it is protected and who can see it.

Accounts

Passwords are stored only as bcrypt hashes — nobody at SMSHub can see them.
Two-step verification with an authenticator app or SMS codes, plus one-time backup codes.
Sessions use secure, HTTP-only, host-bound cookies and end after 2 hours of inactivity.
Sign-in attempts and verification codes are rate-limited; you can sign out of every device from Settings.
Team members sign in with their own accounts and only get the access their role allows.

API keys

Keys are checked by their SHA-256 hash. The copy that lets you view a key again is encrypted with AES-256-GCM using a secret kept outside the database.
Create a separate key per app, revoke any key instantly, and lock each key to your server's IP addresses.
Keys stop working automatically if an account is suspended.
Every request is rate-limited (60 per minute) and returns a request ID for tracing.

Identity documents

ID images are kept in a private storage folder under random file names and are never sent by e-mail.
Administrators open them only through short-lived signed links.
They are used only to verify who is sending.

Payments

Payments are processed by Chapa; SMSHub never sees your card, telebirr PIN or bank password.
Every payment is verified with Chapa on our server before credits are added — never from the browser.
Chapa webhooks are signature-checked and de-duplicated. Sending a refund requires the administrator to re-enter their password.

Messages

Each message carries the verified sender's name, so recipients know who wrote to them.
Automated checks block phishing, scams, threats and hate speech before anything is sent; repeat abuse suspends the account.
Message history stays in your account so you can search and export it. Codes sent with the Verify API are masked in the history.

Web & webhooks

HTTPS everywhere with HSTS, a strict Content-Security-Policy and CSRF tokens on every form.
Webhooks are signed with HMAC-SHA256 and a timestamp, sent only to public HTTPS addresses, never follow redirects.
The admin console is separate from the customer site; administrators have individual accounts with limited permissions, and their actions are logged.

Found a security problem?

Please tell us privately at support@smshub.et or on Telegram @hizkiel_23 before sharing it publicly. We reply quickly and credit you if you like.

Privacy policy System status