Straight answers
What happens to the credentials you paste
You're about to hand an API key to a tool you found on the internet. That deserves a real answer rather than a privacy policy, so here it is.
We can only read, never write
The scanner asks Twilio for information and does nothing else. It cannot send a message, change a registration, or spend your balance — not because we promise not to, but because the code contains no way to. The complete list of requests it can make is on the right.
Your keys last minutes, not days
The moment you submit, your credentials are encrypted and handed to the scan. They're destroyed as soon as it finishes — whether it succeeds, fails, or crashes — and a sweeper clears anything older than fifteen minutes regardless. They never appear in our logs and are never stored next to your report.
What we do keep
The results: which brands and campaigns are in what state, and the findings. No credentials, ever. They sit behind an unguessable link for 30 days and are then deleted. If you ask us to email the report, we keep your address — that's the trade for a free tool, and it's the only thing we'd contact you about.
No third parties on this page
No analytics scripts, no tag managers, no CDN fonts. Typefaces are served from our own domain, so loading this page tells nobody but us that you were here.
The safest way to use this
Create a Twilio Restricted API Key with read-only access to Messaging and Accounts, use that instead of your auth token, and delete it once you have your report. Then even a total compromise on our side is worth nothing.
Still not sure? Read a full sample board first — it asks nothing of you.
See the sample board