In short
- People: two-factor login with a verification code sent by email; admin and user permission levels.
- Systems: API access from whitelisted IP addresses or a VPN connection.
- Content: message templates approved by your team and by Interkey.
- Traffic: fraud protection, country blocking and spending limits on your account.
- Identity: sender names registered with the operators through CST's central bulk-SMS system during onboarding.
- Permit: Interkey holds CST's permit to provide short message services (SMS).
- Records: a delivery receipt for each message, and reports you can export.
Security controls in Digital Connect
| Area | Control | Who sets it up | Settle at onboarding |
|---|---|---|---|
| Platform sign-in | Two-factor authentication: a verification code sent to the user's email, in addition to the password | Part of the platform login | Which users need access, and how access is handled when someone's email changes |
| User rights | Admin and user permission levels | Your platform admin | Who holds admin rights, and how leavers are removed |
| System access | API access limited to whitelisted IP addresses, or a VPN connection | Your IT team supplies the addresses or VPN details | Which environments need access, test and production, and who may change the list |
| Message content | Templates approved by your team and by Interkey before use | Your content owners, then Interkey | Who in your team signs off a new template |
| Traffic | Fraud protection, country blocking and spending limits | Agreed for your account | Which countries you send to, and which limit fits your normal volume |
| Sender identity | Sender names registered with the operators through CST's central bulk-SMS system | Interkey, during onboarding | Which sender names you need, by brand or department |
| Records | A delivery receipt for each message; exportable reports | Available in the platform | Which reports your audit or operations team needs |
How the controls fit an integration
- Your IT team lists the server IP addresses that will connect, for test and production, or arranges a VPN connection.
- Your platform admin creates users and assigns admin or user level.
- Your content owners prepare templates, which your team and Interkey approve before use.
- You agree the countries you send to and the spending limit for the account.
- Interkey registers your sender names with the operators through CST's central bulk-SMS system.
- Your systems connect over REST, SMPP for high-volume SMS, or SOAP where an existing business system needs it.
Questions to settle in writing before you sign
Security questionnaires for an SMS provider cover the same ground. The controls above answer part of it. The rest depends on your traffic, your contract and how you classify your data, so get these answers in writing for your setup:
- Where data is held: ask separately about message content, delivery receipts and any customer data your systems send through the integration.
- Retention: how long message content and logs are kept, and how you can request deletion.
- Credentials: how API credentials are issued, stored and replaced, and what happens when a whitelisted IP address changes.
- Access reviews: who can see the list of platform users and their levels, and how often it is reviewed.
- Incident contact: who you call, and how an incident is reported to you. Support for Digital Connect comes from Interkey's team in Riyadh, in Arabic and English.
Send us your questionnaire and we will answer it in writing for the services you plan to use.
Permit and certifications
Interkey holds CST's permit to provide short message services (SMS). Interkey also holds ISO/IEC 27001:2022 certification for information security management and ISO 9001:2015 certification for quality management, both issued by AQC and valid until 12 February 2029. Each certificate states its scope; ask us for copies and check the scope against your requirement.
Controls that stay on your side
Some protections can only sit in your own systems:
- Keep API credentials on your servers, never inside a mobile app or browser code. IP whitelisting or a VPN then adds a second barrier: a leaked credential alone cannot connect from an address that is not on your list.
- Limit how often one number, device or session can trigger a message, especially on sign-up, login and password-reset screens.
- Detect non-human traffic on screens that send messages, for example with a challenge on repeated requests.
- Remove platform users promptly when they change role or leave.
SMS pumping protection for OTP senders
Who reviews an SMS gateway this way
Organisations whose messages carry codes, account alerts or official notices put an SMS provider through a security review before go-live: banks and fintech sending OTP and account alerts, government entities and utilities sending service notices, and large enterprises with an information security policy for suppliers.
When Digital Connect is not a good fit: if almost all of your recipients are outside Saudi Arabia, or you send only a few hundred messages a month.
Questions security teams ask
How does two-factor login work?
Platform users sign in with their password and a verification code sent to their email address.
Can we limit what each user can do?
Yes. The platform has admin and user permission levels. Ask us during onboarding which permissions each level includes.
Can the API be called from anywhere?
No. Your systems connect from whitelisted IP addresses or over a VPN connection.
Who approves message templates?
Your team and Interkey both approve a template before it is used.
Can we stop messages going to countries we do not serve?
Yes. Country blocking limits the account to the countries you allow, and a spending limit caps what the account can spend.
Where is our message data stored?
Ask us in writing, for your setup, about message content, delivery receipts and integration data separately. We answer for the services you plan to use.
Do you hold ISO/IEC 27001?
Interkey holds ISO/IEC 27001:2022 certification, issued by AQC and valid until 12 February 2029. Ask us for a copy; the certificate states its scope.