Security Advisory

GDPR Compliance & Telecom Retention

How telecom platforms maintain GDPR compliance: cryptographic hashing, automated retention purges, and right-to-be-forgotten implementation.

Data Privacy & Automated Retention Windows

Inbound SMS messages frequently contain personally identifiable information (PII). Under GDPR Article 5(1)(e), data must be erased as soon as verification is complete.

GDPR Data Processing Principles for SMS:

Storage Limitation: Automated cron purges delete messages older than 24 hours on public lines.
Data Minimization: Sender phone numbers are masked (e.g. +1202***0101) to protect sender privacy.
Cryptographic Vaulting: Developer API keys are stored exclusively as irreversible SHA-256 hashes.
Right to Erasure: Developers can trigger immediate permanent deletion of test event payloads.

SMSRiver enforces strict data minimization across its edge infrastructure running on Cloudflare Workers and D1, with zero persistent logging of message text beyond plan retention.

Recommended Enterprise Practice: Configure your workspace data retention preferences in the SMSRiver API to match your corporate compliance requirements.