Messaging security in five layers: platform, account, data, operations and telecom
Five layers, every message.
Platform, account, data, operational, and telecom security — applied to every byte of traffic that crosses the BroadNet network. Certifications and audit reports at the Trust Center.
Platform security
Secure API access, network controls, and rate limits — applied at the edge before any message reaches your account.
TLS 1.3 + HTTP/2
All API and SMPP traffic over TLS 1.3 with modern cipher suites. HTTP/2 on REST.
API authentication
Per-account Bearer access tokens on every API request, sent over TLS. The legacy HTTP API for SMPP-era integrations authenticates with account credentials.
IP allowlisting
Per-tenant IP allowlist on production routes. Mandatory on enterprise tier; recommended on all tiers.
Rate limits
Per-key, per-tenant, per-second AND per-day. Configurable burst budget for verified senders.
WAF + DDoS protection
Automated WAF rules at the edge with rate-based and behavior-based filtering.
Webhook delivery
Every outbound DLR and event webhook is sent over TLS 1.3 to the endpoint you register.
Account security
Identity, access, and accountability for everyone who touches your BroadNet workspace.
RBAC
Role-based access control with admin / editor / viewer / billing scopes. Custom roles on enterprise tier.
2FA / TOTP
Mandatory two-factor authentication for admins. TOTP via any RFC 6238 authenticator app. Backup codes.
Audit logs
Every state-changing action recorded with actor, timestamp, IP, user-agent, and before/after diff. 90-day retention standard, 7 years on enterprise.
Permission management
Granular permissions per product (messaging / firewall / sender-ID / analytics).
Session controls
Configurable session timeout, idle lockout, password expiry, complexity rules.
Admin activity tracking
Real-time admin-action stream pushed to your SIEM via webhook or pulled via API.
Data protection
Data minimization first; encryption everywhere; retention controlled by you.
Data minimization
We collect only what's needed to route, deliver, and audit messages. PII fields can be excluded from logs at the per-template level.
Encryption in transit
TLS 1.3 on every external connection. Mutual TLS available for high-trust integrations.
Encryption at rest
AES-256 at rest with per-tenant key derivation. Key rotation handled by the platform; customer-managed keys (CMK) on enterprise tier.
Retention controls
Message body retention configurable per workspace (24h to 7 years). DLR + audit retention configurable separately.
Secure logs
Webhook logs and analytics streams scrub PHI / PII / payment data by default for healthcare and financial workloads.
Customer data separation
Per-tenant logical separation in the database; row-level access guards in the application layer.
Operational security
People, process, and tooling that keep the platform running and recovering when something goes wrong.
24/7 NOC
Network operations center monitoring routing, latency, delivery rate, and operator binds continuously.
Backups
Hourly database snapshots, daily off-site replicas, monthly archives. Tested restore quarterly.
Disaster recovery
Active-active multi-region routing for production traffic. RTO 1 hour, RPO 5 minutes. Quarterly DR drills.
Incident handling
Documented severity matrix (P1-P4), 24/7 on-call, named incident commander, RFO/RCA within 5 business days of any Sev-1.
Vulnerability management
Automated SAST + DAST + dependency scanning on every build. 30-day SLA for high-severity remediation. Annual third-party penetration test.
Change management
Every production change reviewed, tested in staging, deployed with progressive rollout and automated rollback.
Telecom security
Threats specific to messaging and signaling networks — controlled at the wire, not just at the API.
SMS Firewall
Inline filtering of A2P traffic with DPI + ML-based scoring. Detect, control, block, and monetize. Deployed inside operator networks.
SS7 Firewall
Signaling firewall covering MAP/Diameter aligned with GSMA FS.07 / FS.11. Protects subscriber location, identity, and messaging routes.
Flash-call monitoring
Identify verification-bypass traffic and recover the A2P SMS revenue it leaks. Available as operator-side or enterprise-side control.
Grey-route detection
Per-route quality scoring + behavioral anomaly detection to identify unauthorized A2P delivery paths.
Sender ID protection
Sender ID registry + spoof-detection layer. Brands register sender IDs once; the registry validates per-message at MNO boundary.
OTP abuse analysis
Pattern review for repeated OTP requests, suspicious destination spikes, throttled enumeration, and credential-stuffing signatures.
Security questions, answered.
Yes. All API traffic uses TLS 1.3 in transit; data at rest is encrypted with AES-256, and customer-managed keys (CMK) are available for enterprise accounts.
Keys are per-account, IP-allowlistable, rotatable and least-privilege scoped. Dashboard access is protected by RBAC and 2FA/TOTP.
A carrier-grade SS7 and SMS firewall, grey-route detection, sender-ID controls and anti-fraud filtering protect the signalling and messaging layers.
ISO 27001, ISO 27018, ISO 9001, ISO 22301 and SOC 2 Type II, plus GDPR compliance; GSMA SAS-SM accreditation is in progress. Audit reports are available under NDA.
No: GDPR is a regulation BroadNet complies with, not a certificate it holds. Customers can sign BroadNet's Data Processing Agreement (DPA), published at /legal/dpa, which sets out how personal data is processed on their behalf.
A 24/7 NOC monitors the platform; confirmed breaches affecting customer data are notified within 72 hours, coordinated with the affected customers.
Question not here? Ask our engineering team
Security questionnaire,
ours or yours.
We accept SIG, CAIQ, your in-house template, or send back ours. Either way, one business day under NDA.