Last updated: August 24, 2026
Every API request and WebSocket connection is authenticated with a per-tenant API key (prefix cm_live_). Keys are shown once at creation and stored only as SHA-256 hashes. You can create and revoke keys from the dashboard at any time, and each key tracks when it was last used so stale credentials are easy to spot. Dashboard sign-in is handled by Clerk.
Messaging events from our upstream provider are accepted only after HMAC-SHA256 signature verification with a timestamp check that rejects events older than five minutes, protecting the pipeline against forged and replayed deliveries before anything is routed to your agent.
Your agent connects over an authenticated WebSocket — no public URL or inbound firewall hole required on your side. The connection is health-checked every 30 seconds with automatic eviction of dead connections, and the protocol carries delivery status events (delivered, read, failed), tapback reactions, typing indicators, and read receipts, so your agent can verify that every message actually reached the recipient. Sending works over REST or the same WebSocket.
We log messages, both content and metadata (direction, timestamp, phone number), to route conversations to the right agent, debug delivery issues, and bill accurately. Logs are scoped to your tenant and are not used to train models or shared with other customers. If you want a walkthrough of exactly what we retain and for how long, email us. See the privacy policy for the full picture.
Payments are processed by Stripe; we never store card numbers. Plans are flat: your monthly message quota is the only usage metering, with no carrier, number, or per-message surcharges on standard plans. Cancel any time from the billing page — no contracts, no cancellation fees.
We operate the iMessage line upstream as a managed service — line health, protocol fallback from iMessage to RCS to SMS, and provider relationships are our job, not yours. There is no Mac, SIM, or iCloud account for you to maintain, and nothing about your deployment changes: run your agent on Linux, Docker, Windows, or any cloud.
Found something? Email security@clawmessenger.com and we will respond quickly. Please include steps to reproduce.