Security at PhoneBorn

Your account is protected by an email address and a password — nothing else identifies you.

• Password hashing. Passwords are hashed with bcrypt, a deliberately slow, salted algorithm. We store only the hash, never the password itself.
• Session cookie. After you sign in, your browser holds a signed session token in an httpOnly cookie, which page scripts cannot read. It is strictly necessary, and we set no advertising or cross-site tracking cookies.
• Sign-out everywhere on password change. Changing or resetting your password invalidates your other sessions, so a device that should no longer have access is signed out.
• Bot protection. Sign-up, sign-in, password reset and contact forms use Cloudflare Turnstile to separate people from automated scripts.
• Rate limits. Sign-in, sign-up, verification and password-reset attempts are rate-limited per network address to slow down password guessing and code guessing.
• Email codes. Email verification and password resets use 6-digit codes that expire after 15 minutes and allow a limited number of attempts. The codes are stored as keyed hashes, not in plain text.
• Sensitive actions need your password. Deleting your account requires re-entering your current password; changing it requires the old one.

API keys

A new API key is displayed once, at creation. We keep only a SHA-256 hash of it plus a short prefix so you can tell your keys apart in the dashboard. If you lose a key, revoke it and create a new one — we cannot show it again. You can hold up to 10 active keys, so each integration can have its own. Keys are sent in the X-API-Key header; never put them in URLs, client-side code or public repositories.

Signed webhooks

When an SMS arrives, PhoneBorn can POST it to your webhook URL. Each request body is signed with HMAC-SHA256 using your webhook secret, and the signature is sent in the X-PhoneBorn-Signature header (prefixed with sha256=). Verify it on your server before trusting the payload, and use a constant-time comparison. Webhooks are delivered only to public internet addresses and do not follow redirects. Endpoint details are in the phone number API docs.

PhoneBorn is crypto-only, and the payment flow is designed so that we never need access to your funds.

• You send, we watch. Each invoice gives you an exact amount, a network and one of our public receiving addresses. For supported stablecoin networks we detect the payment by watching those addresses on-chain with read-only access. Other coins go through a payment processor, whose payment notifications are verified by signature before your wallet is credited.
• No wallet connection. You never connect a wallet to PhoneBorn or sign a transaction on our site.
• No keys, ever. We will never ask for your private keys, seed phrase or recovery words — not by email, not in support, not in the dashboard. Anyone who does is not PhoneBorn.
• No card data. Because we do not accept cards or bank transfers, we never hold card or bank details.

Crypto payments are irreversible, so check the network and amount before you send. Underpaid invoices are not credited automatically; support reviews them. More in paying for online services with crypto.

The data we never collect cannot leak. In line with our Privacy Policy:

• Email-only accounts. No name, ID documents, address, date of birth or existing phone number.
• Service data only. SMS content and SMS/call metadata (other party, direction, time, duration) are stored so you can see your history, track allowances, apply the money-back guarantee and investigate abuse. They are visible only to you, and to authorised staff when needed for a support request or abuse report.
• No call recordings. Calls are connected in real time; their audio is not recorded.
• Limited retention. An automated retention job deletes old SMS content and clears stored sign-in IP addresses on the schedule set out in the Privacy Policy.
• No selling, no ad trackers. We do not sell or rent data and we do not use advertising or cross-site tracking cookies.

Data is encrypted in transit with TLS, and access to production systems is restricted and logged. No system is perfectly secure, and we would rather tell you that than claim otherwise.

Some protections only work if you do your part. A few habits make the biggest difference:

1. Use a unique password for PhoneBorn, ideally generated by a password manager.
2. Protect your email. It is the only way to prove you own your account, because there is no ID on file. Turn on two-step verification for your email account.
3. Never share codes. No PhoneBorn staff member will ask for your password, a verification code or an API key. The same applies to codes that arrive on your PhoneBorn number from other services.
4. Keep 2FA numbers renewed. If a PhoneBorn number receives codes for important accounts, keep auto-renew on and your wallet topped up. A released number can no longer receive those codes — see keep your number for 2FA.
5. Rotate keys when people or systems change. Revoke API keys you no longer use and rotate your webhook secret if you suspect it leaked.
6. Watch for phishing. Check that the address bar shows phoneborn.com before you enter your password.

If you believe you have found a vulnerability in PhoneBorn, email [email protected] with "Security" in the subject, a description of the issue, the steps to reproduce it and its potential impact. A person reads every report and replies within 24 hours.

Please act in good faith: test only against your own account, do not access or modify other customers' data, do not degrade the service, and give us reasonable time to fix the issue before disclosing it publicly.

If you suspect someone has accessed your account, change your password immediately (this signs out other sessions), revoke your API keys and contact support.