The short answer
- People: platform users sign in with two-factor authentication, using a verification code sent by email, and work at admin or user permission level.
- Systems: your servers connect from IP addresses on your whitelist, or over a VPN connection.
- Content: message templates are approved by your team and by Interkey before they are used.
- Traffic: fraud protection, country blocking and spending limits apply to your account.
- Identity: your SMS sender name is registered with the regulator and the operators during onboarding.
- Records: a delivery receipt for each message, and reports you can export.
The controls in detail
| Control | What it does | Who sets it up | Questions to settle at onboarding |
|---|---|---|---|
| Two-factor authentication (2FA) | Platform users confirm sign-in with a verification code sent to their email, not with a password alone | Part of the platform login | Which users need access, and how access is handled when someone's email address changes |
| Admin and user permission levels | What each person can do in the platform follows their permission level: admin or user | Your team's platform admin | Who holds admin rights, which permissions users need, and how leavers are removed |
| Whitelisted IP access or VPN | Your systems connect from IP addresses on your whitelist, or over a VPN connection | Your IT team supplies the addresses or the VPN details | Which environments (test, production) need access, which option suits each, and who can change it |
| Approved message templates | Templates are approved by your team and by Interkey before they are used | Your content owners, then Interkey | Who in your team approves a new template before it goes to Interkey |
| Fraud protection, country blocking and spending limits | Protects your account's traffic, limits sending to the countries you allow, and caps what the account can spend | Agreed for your account during onboarding | Which countries you send to, and which spending limit fits your normal volume |
| Registered sender name | Your SMS sender name is registered with the regulator and the operators before launch | Interkey, during onboarding | Which sender names you need, by brand or department |
| Delivery receipts and reports | A delivery receipt for each message, one set of delivery reporting, and exportable reports | Available in the platform | Which reports your audit or operations team needs, and how often |
What your security review will ask, and how to get the answers
Security questionnaires for a messaging provider tend to cover the same ground. Some questions are answered by the controls above. Others depend on your traffic, your contract and your data classification, so ask for them in writing, for your setup:
- Where message data is held: ask separately about message content, delivery receipts and any customer data you send through the integration. One answer for all three is not enough.
- How long message content and logs are kept, and how you can request deletion.
- How API credentials are issued, stored and replaced, and what happens when a whitelisted IP address changes.
- How user access is reviewed: who sees the list of platform users and their permission levels, and how often.
- Support and incident contact: Interkey supports Digital Connect from Riyadh on the Saudi working week, Sunday to Thursday, in Arabic and English. Agree the incident contact route in your contract.
Send us your questionnaire and we will answer it for your planned setup, in writing.
Company certifications
Interkey holds ISO/IEC 27001:2022 certification for information security management and ISO 9001:2015 certification for quality management, issued by AQC on 13 February 2026 and valid until 12 February 2029. Each certificate states its scope; ask us for copies.
Controls that stay on your side
Some protections can only sit in your own application, because they depend on how your users reach it. The OWASP API Security Top 10 (2023) recommends measures like these, and uses an SMS password-reset flow as one of its examples:
- Limit how often one number, device or session can request a message, especially on sign-up, login and password-reset screens.
- Set spending limits, or billing alerts where limits are not possible, with every provider that charges per message. In Digital Connect, spending limits are part of your account.
- Detect non-human traffic on the screens that trigger messages, for example with a challenge on repeated requests.
Also keep API credentials on your servers, never inside a mobile app or browser code. IP whitelisting or a VPN connection on the platform side then adds a second barrier: a leaked credential alone is not enough to connect from an address that is not on your whitelist.
OTP fraud and SMS pumping: signs and controls
How the controls fit an integration
- Your IT team lists the IP addresses of the servers that will connect, for test and production, or arranges a VPN connection.
- Your platform admin sets up users and their permission levels.
- Your content owners prepare templates, which your team and Interkey approve before use.
- You agree the countries you send to and your spending limit for the account.
- Interkey registers your sender names with the regulator and the operators.
- Your systems connect over REST, SMPP for high-volume SMS, or SOAP where an existing business system needs it.
How SOAP, REST and SMPP fit enterprise systems
When Digital Connect is not a good fit
Digital Connect is built for Saudi traffic. It is not a good fit if almost all of your recipients are outside Saudi Arabia, or if you send only a few hundred messages a month.
Questions security teams ask
How does two-factor login work?
Platform users sign in with their password and a verification code sent to their email address.
Can we limit what a user is allowed to do?
Yes. The platform has admin and user permission levels, so what a person can do follows their level. Ask us during onboarding which permissions each level includes.
Can the API be called from anywhere?
No. Your systems connect from whitelisted IP addresses or over a VPN connection. List the servers that will connect, for test and production.
Who approves message templates?
Templates are approved by your team and by Interkey before they are used. Agree inside your team which messages must always go from an approved template, and who signs off a new one.
Can we stop messages going to countries we do not serve?
Yes. Country blocking limits your account to the countries you allow, and a spending limit caps what the account can spend. Ask us to set both during onboarding.
Where is our message data stored?
Ask us in writing, for your setup, about message content, delivery receipts and integration data separately. We answer for the services you plan to use.
Do you hold ISO/IEC 27001?
Interkey holds ISO/IEC 27001:2022 certification, issued by AQC and valid until 12 February 2029. Ask us for a copy; the certificate states its scope.