Built to be trusted with your data.
Messaging touches your customers’ phone numbers, conversations and consent. SimplyRCS builds to the SOC 2 framework, encrypts your data, runs on US-based infrastructure, and builds compliance in at every layer.
- SOC 2-aligned controls
- Encrypted in transit & at rest
- US-based infrastructure
- TCPA & 10DLC compliant
- Tier-1 carriers via Signalmash
HTTPS and TLS everywhere in transit, encrypted at rest, and media served through signed URLs rather than open links.
Roles enforced in the interface and at every API endpoint, keys scoped to read, write or admin, webhooks signed, SSO supported.
STOP and HELP honored above your bots and agents, consent checked before every send, every consent event logged.
US-based data centers, monitored and communicated on, with fallback across RCS, MMS and SMS decided per recipient.
Tier-1 carrier connectivity run by Signalmash, the company that builds the platform, between your message and the handset.
Security isn’t bolted on. It’s the architecture.
Some platforms treat security as a checklist they pass once a year. We treat it as how the product is built: compliance keywords enforced above the application, access scoped by default, carrier connectivity run in-house.
Security as a checklist
- Audited once a year, then filed away
- Compliance left to application code to remember
- Traffic resold through layers you cannot audit
Security as architecture
- Controls built to a framework and kept operating, not filed away
- Keywords enforced beneath the application, above your code
- Carrier connectivity run by the team that builds the platform
Built to the frameworks buyers ask about.
The frameworks enterprise and regulated buyers ask about. Pick one to read what it covers.
SOC 2-aligned controls
Security, availability and confidentiality controls built to the SOC 2 framework. Request our security documentation from the security team.
TCPA compliance
Immutable STOP, START and HELP handling, per-channel consent tracking, and a complete audit trail of every consent event.
10DLC and carrier vetting
Brand and campaign registration through The Campaign Registry, plus carrier vetting for every sender.
Your data, encrypted and contained.
Phone numbers, message content, conversations and consent records are protected in transit and at rest, with access tightly controlled. Encryption on the RCS channel itself is a different question, answered in is RCS encrypted?
Encrypted in transit
All data moving to and from SimplyRCS is encrypted over HTTPS and TLS.
Encrypted at rest
Stored data, including message content and contact records, is encrypted at rest.
Durable, controlled storage
Records are stored durably with controlled access; media is served via signed URLs.
Data minimization
We keep the data needed to run your messaging and reporting. Your customer data is yours, never repurposed.
Least privilege, by default.
Access to your account and data is scoped, authenticated, and revocable, for your team and for any system connecting through the API.
Role-based permissions
Admin, Brand Admin, Agent and Viewer roles, enforced in the interface and at every API endpoint.
Scoped API keys
Keys are scoped to read, write or admin, can be rotated or revoked at any time, and the secret is shown once at creation.
Signed webhooks
Every webhook is cryptographically signed so you can verify it came from SimplyRCS.
SSO support
Single sign-on is supported so you can manage access through your own identity provider.
Rules a bug can’t break.
Compliance is enforced at the platform layer, beneath everything else. STOP, HELP and opt-out keywords are honored instantly, above both your AI bots and your agents. Per-channel consent is checked before every send. A developer’s mistake or an AI’s misstep can’t override a customer’s opt-out.
- Immutable STOP and HELP: opt-out keywords enforced above AI and agents, always honored
- Consent checked per send: the platform suppresses sends to anyone not opted in on that channel
- Layered content rules: the most restrictive rule always wins, automatically
- Complete audit trail: every consent event and submission logged and reviewable
Carrier-grade, US-based, dependable.
Tier-1 carrier connectivity and US-based infrastructure, built by a team with deep telecom operating experience, for critical paths like verification and alerts.
No reseller sits between the platform and the carrier.
Your data and message traffic stay on US infrastructure.
The message lands on whichever the handset supports.
Platform health and incidents are tracked and communicated.
Found something? Tell us.
If you believe you’ve found a vulnerability, email our security team directly. We respond promptly, follow responsible disclosure, and credit researchers.
- We respond promptly
- We follow responsible-disclosure practices
- We credit researchers who help keep the platform safe
Security questions.
Is SimplyRCS secure?
Yes. SimplyRCS builds its controls to the SOC 2 framework, encrypts data in transit and at rest, runs on US-based infrastructure, scopes access by role and API key, and enforces compliance, including opt-outs and consent, at the platform level. Security is built into the architecture, not added as a feature.
Is RCS messaging secure for business?
RCS supports verified senders, which lets customers confirm a message is genuinely from your brand, a meaningful security improvement over plain SMS, where senders can be spoofed. On the platform side, SimplyRCS adds encryption, scoped access, signed webhooks, and audit logging to protect your messaging program end to end.
Is SimplyRCS SOC 2 compliant?
SimplyRCS builds its security, availability and confidentiality controls to the SOC 2 framework. Customers can request current security documentation under NDA by contacting the security team.
How is my customer data protected?
Customer data, phone numbers, message content, conversations, and consent records, is encrypted in transit and at rest, stored with controlled access, and served via signed URLs. Access is governed by role-based permissions and scoped API keys, and SimplyRCS practices data minimization, using your data to deliver your service rather than repurposing it.
Where is my data stored?
SimplyRCS runs on US-based infrastructure, keeping your data and message traffic in-country.
How does SimplyRCS handle opt-outs and consent?
Opt-out keywords like STOP and HELP are enforced at the platform level, above your AI bots and agents, so they are always honored instantly. Consent is tracked per channel and checked before every send, and every consent event is logged in a complete audit trail, so compliance cannot be bypassed by application code.
How do I report a security vulnerability?
Email security@simplyrcs.ai. We respond promptly, follow responsible-disclosure practices, and credit researchers who help keep the platform secure.
Put it in front of your security team.
Book a meeting and bring your security questions. We’ll share documentation under NDA and complete your security questionnaire.