How Phonekit is built

Signing in

Passkeys only. There is no password to phish, reuse or leak, and we never see one.

Add a second passkey on a second device so you always have a way in.

You also get ten single-use recovery codes when you set up your account. If you lose every device with a passkey, one of those signs you in and walks you through creating a new one.

Who can reach what

• OrganizationsA number is held by one organization. Belonging to one organization gives you nothing in another, even with the same email address.
• MembersSee the numbers shared with everyone, plus the ones granted to them specifically. Nothing else.
• Owners and adminsCan open every number in their organization, including restricted ones. The number itself says so.
• API keysRead only the numbers explicitly selected for them. Number or webhook management is a separate permission an owner or admin grants deliberately, on separately selected numbers. Shown once, revocable, and recorded when created or revoked.

What is recorded

Messages opened, codes copied, numbers claimed and released, access granted and removed, and API keys created and revoked. Each entry records who, what and when, in Settings → History.

A recorded copy means someone pressed Copy code. Where a code goes after that is not recorded.

Storage and email

Messages are encrypted at rest. Admins choose who receives each number's messages by email. Those emails include the message and any recognized code so people can act from their phone. Each person can stop emails for themselves. Unsent SMS emails are checked against current access before sending; emails already handed to the email provider cannot be recalled.

Security questions

If you need specific security commitments before you can use Phonekit, tell us when you join the interest list and we will answer directly.