Trust & legal

Security

A text message can book an appointment or start a car. We design every service on the assumption that someone will try to misuse it.

Verified requests

Every incoming message reaches our servers through a request signed by our messaging provider. We check that signature and reject anything that does not match, so a forged request cannot pretend to be a text from you.

Allowed numbers only

Services that act on something you own, such as Remote Start, accept commands only from the numbers registered to them. Sensitive commands, such as unlocking, ask you to confirm before anything happens.

Encrypted in transit

Connections between our servers, our providers and this website use TLS. Credentials for connected services are never sent or requested by text.

Separated services

Each service runs separately with only the access it needs, so a problem in one cannot reach the others.

Registered senders

Our messaging programs are registered with US carriers under the A2P 10DLC framework, which ties every number to a verified business and use case.

We never ask

No TabulaSMS service will ever text you asking for a password, a verification code or payment card details. If a message claiming to be from us does, it is not from us.

Report a vulnerability

If you believe you have found a security problem in one of our services or this website, email security@tabulasms.com. Include what you found, how to reproduce it and its likely impact.

We will acknowledge your report and keep you updated while we fix it.
Please give us reasonable time to fix the issue before sharing it publicly.
Do not access, change or delete other people’s data, send messages to numbers you do not own, or disrupt our services while testing.

We will not pursue legal action against anyone who reports a problem in good faith and follows these guidelines.

To report a suspicious message that claims to be from us, see report spam.