Security

What actually happens to your data — and what doesn't.

What goes to the control plane — and what never does

The gateway sends aggregated counters, decision codes, the destination's calling code, a truncated IP prefix, and a truncated hash of the request — never the message payload, the full phone number, or any credential. This is the complete list; nothing else leaves your infrastructure.

Your provider credential never leaves your infrastructure

Your Twilio auth token is read from your own environment and used to validate incoming request signatures — it is never logged, never transmitted to the control plane, and never stored anywhere outside your deployment.

A compromised control plane can't expose your production credentials

Because they were never sent there in the first place. An intrusion into B2D Core's control plane exposes aggregated counters, not a single customer's Twilio credential or message content.

Native AOT, not the .NET you might be picturing

This isn't a runtime installed on a shared Windows box. The gateway ships as a Native AOT self-contained binary — there is no separate .NET runtime to trust or patch, and the container image is built on mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled: no shell, no package manager, the same minimal attack surface you'd expect from a same-sized Go binary. .NET itself (the runtime, the SDK, the language) has been open source and MIT-licensed under the .NET Foundation since 2014 — not the "Microsoft-licensed .NET" some still picture.

Subprocessors

As of today, B2D Core's control plane runs on:

• Cloudflare — DNS, this website, and edge functions.
• Oracle Cloud Infrastructure — control-plane compute and the NoSQL database aggregated counters are stored in.