# Messaging security in five layers: platform, account, data, operations and telecom - Canonical URL: https://www.broadnet.me/security - Language: en - Last updated: 2026-10-20 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. Security Five layers, every message. Platform, account, data, operational, and telecom security — applied to every byte of traffic that crosses the BroadNet network. Certifications and audit reports at the [Trust Center](https://www.broadnet.me/trust). ![BroadNet five-layer security](https://www.broadnet.me/marketing/generated/viz-security.png) Security Five-layer defense ISO 27001 certified SOC 2 Type II 99.99% SLA 01 · Platform security ## Platform security Secure API access, network controls, and rate limits — applied at the edge before any message reaches your account. ### TLS 1.3 + HTTP/2 All API and SMPP traffic over TLS 1.3 with modern cipher suites. HTTP/2 on REST. ### API authentication Per-account Bearer access tokens on every API request, sent over TLS. The legacy HTTP API for SMPP-era integrations authenticates with account credentials. ### IP allowlisting Per-tenant IP allowlist on production routes. Mandatory on enterprise tier; recommended on all tiers. ### Rate limits Per-key, per-tenant, per-second AND per-day. Configurable burst budget for verified senders. ### WAF + DDoS protection Automated WAF rules at the edge with rate-based and behavior-based filtering. ### Webhook delivery Every outbound DLR and event webhook is sent over TLS 1.3 to the endpoint you register. 02 · Account security ## Account security Identity, access, and accountability for everyone who touches your BroadNet workspace. ### RBAC Role-based access control with admin / editor / viewer / billing scopes. Custom roles on enterprise tier. ### 2FA / TOTP Mandatory two-factor authentication for admins. TOTP via any RFC 6238 authenticator app. Backup codes. ### Audit logs Every state-changing action recorded with actor, timestamp, IP, user-agent, and before/after diff. 90-day retention standard, 7 years on enterprise. ### Permission management Granular permissions per product (messaging / firewall / sender-ID / analytics). ### Session controls Configurable session timeout, idle lockout, password expiry, complexity rules. ### Admin activity tracking Real-time admin-action stream pushed to your SIEM via webhook or pulled via API. 03 · Data protection ## Data protection Data minimization first; encryption everywhere; retention controlled by you. ### Data minimization We collect only what's needed to route, deliver, and audit messages. PII fields can be excluded from logs at the per-template level. ### Encryption in transit TLS 1.3 on every external connection. Mutual TLS available for high-trust integrations. ### Encryption at rest AES-256 at rest with per-tenant key derivation. Key rotation handled by the platform; customer-managed keys (CMK) on enterprise tier. ### Retention controls Message body retention configurable per workspace (24h to 7 years). DLR + audit retention configurable separately. ### Secure logs Webhook logs and analytics streams scrub PHI / PII / payment data by default for healthcare and financial workloads. ### Customer data separation Per-tenant logical separation in the database; row-level access guards in the application layer. 04 · Operational security ## Operational security People, process, and tooling that keep the platform running and recovering when something goes wrong. ### 24/7 NOC Network operations center monitoring routing, latency, delivery rate, and operator binds continuously. ### Backups Hourly database snapshots, daily off-site replicas, monthly archives. Tested restore quarterly. ### Disaster recovery Active-active multi-region routing for production traffic. RTO 1 hour, RPO 5 minutes. Quarterly DR drills. ### Incident handling Documented severity matrix (P1-P4), 24/7 on-call, named incident commander, RFO/RCA within 5 business days of any Sev-1. ### Vulnerability management Automated SAST + DAST + dependency scanning on every build. 30-day SLA for high-severity remediation. Annual third-party penetration test. ### Change management Every production change reviewed, tested in staging, deployed with progressive rollout and automated rollback. 05 · Telecom security ## Telecom security Threats specific to messaging and signaling networks — controlled at the wire, not just at the API. ### SMS Firewall Inline filtering of A2P traffic with DPI + ML-based scoring. Detect, control, block, and monetize. Deployed inside operator networks. ### SS7 Firewall Signaling firewall covering MAP/Diameter aligned with GSMA FS.07 / FS.11. Protects subscriber location, identity, and messaging routes. ### Flash-call monitoring Identify verification-bypass traffic and recover the A2P SMS revenue it leaks. Available as operator-side or enterprise-side control. ### Grey-route detection Per-route quality scoring + behavioral anomaly detection to identify unauthorized A2P delivery paths. ### Sender ID protection Sender ID registry + spoof-detection layer. Brands register sender IDs once; the registry validates per-message at MNO boundary. ### OTP abuse analysis Pattern review for repeated OTP requests, suspicious destination spikes, throttled enumeration, and credential-stuffing signatures. Questions buyers ask ## Security questions, answered. Yes. All API traffic uses TLS 1.3 in transit; data at rest is encrypted with AES-256, and customer-managed keys (CMK) are available for enterprise accounts. Keys are per-account, IP-allowlistable, rotatable and least-privilege scoped. Dashboard access is protected by RBAC and 2FA/TOTP. A carrier-grade SS7 and SMS firewall, grey-route detection, sender-ID controls and anti-fraud filtering protect the signalling and messaging layers. ISO 27001, ISO 27018, ISO 9001, ISO 22301 and SOC 2 Type II, plus GDPR compliance; GSMA SAS-SM accreditation is in progress. Audit reports are available under NDA. No: GDPR is a regulation BroadNet complies with, not a certificate it holds. Customers can sign BroadNet's Data Processing Agreement (DPA), published at /legal/dpa, which sets out how personal data is processed on their behalf. A 24/7 NOC monitors the platform; confirmed breaches affecting customer data are notified within 72 hours, coordinated with the affected customers. Question not here? [Ask our engineering team](https://www.broadnet.me/contact) ## Security questionnaire, ours or yours. We accept SIG, CAIQ, your in-house template, or send back ours. Either way, one business day under NDA. [Request security questionnaire](https://www.broadnet.me/contact?topic=security-questionnaire) [View Trust Center](https://www.broadnet.me/trust)