Virtual phone numbers
Crypton.sh privacy rating
Phone numbers backed by physical SIM cards hosted in the cloud, for receiving and sending SMS through a web interface, API or Android app, plus eSIM data plans. Stored messages are encrypted with a user key.
Summary
Crypton.sh scores 65 out of 100 (grade C) on the virtual phone numbers criteria. It meets 4 of 9 criteria: no ads or data sales, transparency report, TLS configuration and modern web standards. It partly meets open source, no trackers or telemetry, tells users about requests and security headers. It does not meet independent audit. It is based in the United Kingdom: Five Eyes member; GDPR-style data protection law; CLOUD Act data access agreement with the US. Automated tests: SSL Labs grade A+, Mozilla HTTP Observatory grade B and Internet.nl website score 92%.
Score 65 out of 100. How scoring works
Criteria
-
Partial
Open source Weight 3 of 3
Is all the source code needed to run the product public?
The Android app is GPL-3.0 and the self-hosted BYOD platform is source-available; the main service is closed source.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party advertising trackers, but store builds of the Android app send crash reports to a self-hosted Bugsink server.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Paid service; the privacy policy states data is not sold or used for advertising.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
No independent audit is published.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Publishes yearly counts of government and law enforcement requests and whether data was provided.
-
Partial
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
Affected account IDs are listed in the transparency report for users to check, but there is no promise of direct notice.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (70/100+)
-
Yes
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Score 92%