# Twilio privacy rating

Cloud communications platform with APIs for SMS, MMS, WhatsApp, voice calls, phone number verification and video.

## Summary

Twilio scores 43 out of 100 (grade D) on the SMS and voice APIs criteria. It meets 2 of 10 criteria: transparency report and tells users about requests. It partly meets no ads or data sales, independent audit, TLS configuration, security headers, message content deleted or redacted and EU data location. It does not meet open source and no trackers or telemetry. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A- and Mozilla HTTP Observatory grade B.

- Website: https://www.twilio.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Google Tag Manager, Segment, TrustArc (not scored), VWO
- Category: [SMS and voice APIs](https://privacyratings.com/communications-apis/)
- Also rated: [SendGrid](https://privacyratings.com/email-sending/sendgrid/) (Email sending services), [Twilio Authy](https://privacyratings.com/two-factor-authentication/twilio-authy/) (Two-factor authentication)
- Grade: D (43/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, Segment, Adobe Launch and VWO. |  |
| No ads or data sales | Partial | Funded by usage fees and states data is not sold, but website tracking for targeted advertising counts as sharing under some US state laws. | https://www.twilio.com/en-us/legal/privacy |
| Independent audit | Partial | SOC 2 and ISO 27001 audits are listed, but reports are only available on request through the Twilio Trust Center. | https://security.twilio.com/ |
| Transparency report | Yes | Publishes annual transparency reports with government request counts, responses and how often users were notified. | https://www.twilio.com/en-us/legal/transparency |
| Tells users about requests | Yes | Uses reasonable efforts to notify customers of requests for their information unless prohibited by law. | https://www.twilio.com/en-us/legal/law-enforcement-guidelines |
| TLS configuration | Partial | Grade A- | https://www.ssllabs.com/ssltest/analyze.html?d=twilio.com&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=twilio.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Message content deleted or redacted | Partial | Message bodies are kept until deleted, and can be deleted through the API. Automatic message redaction is only available to Twilio Editions customers. | https://support.twilio.com/hc/en-us/articles/223133687-Deleting-messages-message-media-or-message-bodies |
| EU data location | Partial | Voice and SMS can run in the Ireland (IE1) region. Data residency for SMS in the EU is in beta. | https://www.twilio.com/en-us/changelog/data-residency-for-sms--eu--is-now-in-public-beta |

Source: https://privacyratings.com/communications-apis/twilio/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/communications-apis/twilio.md