Transient message pseudonymization

When the Transient message parameter is used in SMS API requests or if the parameter is checked when sending from the app interface, the message content and recipient number are obfuscated immediately after sending to protect data from possible leaks.

This data is pseudonymized, that is, it is still possible to identify the correct data if you know the original values and have the key but to an outside observer it would be unreadable. This way, it allows you to search for messages if you know the recipient number, or compare sent message content if you have stored it in your own database but for all practical purposes we no longer have access to this data.

The method we use to create these obfuscated values is a SHA-256 HMAC algorithm that uses a key that is derived from a randomly generated per-account key that is combined with a separate secret that is stored outside the database, thus protecting against database leaks. This final encryption key is visible in your account settings.

The way the obfuscated data is formed like this:

Phone = First 16 characters of HEX(HMAC-SHA256(key, country_code + phone_number) )

Content = First 5 characters of original content + ":" + content length in bytes + ":" + HEX(HMAC-SHA256(key, original content) )

Note that the first characters of the original message are stored for easier identification purpose, so we would suggest not putting any sensitive content right in the beginning of the message.

A PHP example of how to derive the HMAC hash from a phone number by yourselves for comparison purposes:

define('HASHSECRETKEY', '...YOURKEY...');
$PhoneHash = substr(hash_hmac('sha256', $OriginalPhone, HASHSECRETKEY), 0, 16);
$ContentHash = hash_hmac('sha256', $OriginalContent, HASHSECRETKEY);

Updated on: 13/11/2026