# Infobip privacy rating

Communications platform with APIs for SMS, WhatsApp, RCS, email, voice calls and phone number verification, plus customer engagement tools.

## Summary

Infobip scores 15 out of 100 (grade F) on the SMS and voice APIs criteria. It partly meets TLS configuration, security headers and message content deleted or redacted. It does not meet open source and no trackers or telemetry. Still needing evidence: no ads or data sales, independent audit, transparency report, tells users about requests and EU data location. It is based in the United Kingdom: Five Eyes member; GDPR-style data protection law; CLOUD Act data access agreement with the US. Automated tests: SSL Labs grade A- and Mozilla HTTP Observatory grade B.

- Website: https://www.infobip.com
- Jurisdiction: United Kingdom. Five Eyes member. GDPR-style data protection law. CLOUD Act data access agreement with the US.
- Home page trackers: Amplitude, Cloudflare Web Analytics (cookieless analytics), Google Analytics, Google Fonts (not scored), Google reCAPTCHA (not scored), Google Tag Manager
- Category: [SMS and voice APIs](https://privacyratings.com/communications-apis/)
- Grade: F (15/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, Google Analytics, Amplitude, Microsoft Clarity, HubSpot, Demandbase and DoubleClick, LinkedIn, Reddit and Microsoft Advertising scripts. |  |
| No ads or data sales | Unknown |  |  |
| Independent audit | Unknown |  |  |
| Transparency report | Unknown |  |  |
| Tells users about requests | Unknown |  |  |
| TLS configuration | Partial | Grade A- | https://www.ssllabs.com/ssltest/analyze.html?d=infobip.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=infobip.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Message content deleted or redacted | Partial | Message content is kept for 3 months by default. A shorter retention period can be requested at no charge. | https://www.infobip.com/policies/data-retention-notice |
| EU data location | Unknown |  |  |

Source: https://privacyratings.com/communications-apis/infobip/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/communications-apis/infobip.md