Yoola SMS serves 1,000+ businesses across Africa — including SACCOs, schools, churches, banks and enterprise customers who trust us with sensitive communications. Here's exactly how we keep your account, your credits and your customers' data safe.
The specific technical measures we've implemented to protect your account, your credits, and your customer data.
All passwords are hashed with bcrypt (cost 12). Even we can't see your password. Legacy SHA-1 hashes are auto-migrated to bcrypt on next login.
One-time passwords are generated using cryptographic random_int() (not predictable rand()), expire after 5 minutes, and are single-use with a 5-attempt lockout.
5 failed login attempts triggers a 30-minute account lockout. Prevents credential stuffing and brute-force attacks.
Sessions are regenerated on login. Changing your password immediately invalidates all other active sessions. Session IDs are HTTPOnly and Secure.
100% of database queries use prepared statements with parameter binding. Zero string concatenation in SQL. Regularly audited by our team.
Every API key is limited to 30 requests per minute and a configurable daily SMS cap. Prevents abuse and protects your credits from runaway integrations.
Administrative and team access requires a one-time code sent by SMS and email in addition to your password. A stolen password alone can't get anyone in.
Outbound messages are automatically screened for known scam patterns — impersonation, phishing, and mobile-money fraud templates — before they're sent.
Any campaign over 5,000 SMS triggers an instant alert to our security team. Unusual activity is investigated within minutes, not days.
Every SMS, credit change, login, and admin action is logged with timestamp, IP address, and user ID. We can reconstruct any event on request.
All traffic to yoolasms.com and our API endpoints is encrypted with TLS 1.2+. HTTP requests are 301-redirected to HTTPS.
Registration certificates and IDs you upload for sender ID requests are stored in a private area that is not reachable from the web. Only authorised staff can open them, and every file is checked before it is accepted.
Once your sender ID is approved it is tied to your account only. Nobody else on the platform can send under your business name.
Recipients who opt out are honoured automatically across the platform, so your campaigns stay compliant and your customers stay in control.
Accounts that break our content policy — scams, impersonation, fraud — are suspended. That protects every honest customer's sender reputation and delivery rates.
We take data protection seriously in every country we serve. Here's what that means for you.
We handle personal data (phone numbers, message content, account information) in accordance with Uganda's Data Protection and Privacy Act, 2019, and we respect the data protection rules that apply in the other countries where we operate. We only process data for the purposes you've authorised.
Message content is retained for delivery reporting and audit purposes for up to 90 days by default. Account data is retained while your account is active. Deletion requests are honored within 30 days.
Your data is stored on servers with our infrastructure provider. We do not sell, rent, or share your customer contact lists with any third party under any circumstances.
Messages are delivered through licensed telecom operators and carrier-grade delivery partners. All payment processing is handled by licensed providers (Flutterwave, Pesapal and mobile money operators). We work only with reputable, compliant partners and share only what is needed to deliver your messages.
Banks, financial institutions, and enterprise customers can request a signed Data Processing Agreement (DPA) as part of vendor onboarding. Contact us at hello@yoolasms.com to request one.
We publish real-time uptime and incident data at status.yoolasms.com. Uptime percentages are calculated from actual measurements — not marketing claims.
We welcome and reward security researchers who help us find and fix vulnerabilities responsibly. Here's what qualifies and what we pay.
| Severity | Examples | Reward |
|---|---|---|
| 🔴 Critical | Remote code execution · Full database access · Authentication bypass allowing mass account takeover · SMS credit theft at scale | UGX 150,000 |
| 🟠 High | Individual account takeover · Admin panel access · SMS spoofing · Significant privilege escalation | UGX 60,000 |
| 🟡 Medium | Sensitive information disclosure · Credit/balance manipulation · IDOR with real impact · Stored XSS in customer areas | UGX 25,000 |
| 🟢 Low | Reflected XSS with limited impact · CSRF on non-critical actions · Verbose error messages leaking system info | UGX 10,000 |
All reporters receive public credit in our Hall of Fame (with your permission). Exceptional reports may exceed these tiers at our discretion. Full rules and exclusions in our Disclosure Policy.
No. Passwords are hashed with bcrypt, so even our team cannot read them. If you forget yours, you reset it — we can't retrieve it.
Only you and the staff who need access to support you or investigate abuse. We never sell, rent or share your contact lists with third parties.
Change your password straight away — this signs out every other session — then contact support@yoolasms.com or WhatsApp us so we can review your account activity.
Yes. Documents are stored privately, outside the public website, and are used only to register your sender ID with the telecom. See "Private Document Storage" above.
Yes, for banks, financial institutions and enterprise customers. Email hello@yoolasms.com to request one.
Report vulnerabilities responsibly to our security team. Please include steps to reproduce, potential impact, and any proof-of-concept code. We respond within 3 business days.
security@yoolasms.comThank you to the researchers who have helped make Yoola SMS more secure.
Want to see your name here? Report a vulnerability to security@yoolasms.com.
Security reports: security@yoolasms.com
Enterprise / DPA requests: hello@yoolasms.com
Machine-readable policy: /.well-known/security.txt
Full disclosure policy: /vulnerability-disclosure