·Print this page

·Customer and Partner Agreements An icon of a down chevron

·Privacy An icon of a down chevron

·Mobile Application Terms An icon of a down chevron Twilio Frontline End User App Terms Twilio Authy App Terms

·Supplier Agreements An icon of a down chevron Supplier Purchase Order Terms and Conditions Country-Specific Terms Supplier Data Protection Addendum Supplier Code of Conduct

·Intellectual Property An icon of a down chevron DMCA Policy Trademark

·Resources for Law Enforcement An icon of a down chevron Government Requests Transparency Report

·Civil Requests An icon of a down chevron Submit a request or subpoena

·Code of Conduct & Ethics Hotline An icon of a down chevron Twilio Code of Conduct Ethics and Whistleblower Hotline Discord Community Code of Conduct Twilio Discord FAQ

·Digital Promotions General Rules An icon of a down chevron Sweepstakes Rules

·Customer Research and User Experience An icon of a down chevron Acknowledgement and Waiver

·Twilio Security Overview

·Last Updated: April 9, 2026

·This Security Overview ("Security Overview") is incorporated into and made a part of the agreement between Twilio and Customer covering Customer's use of the Services (as defined below), including any terms applicable to the processing of personal data set forth therein (collectively, "Agreement"). Any capitalized term used but not defined has the meaning provided in the Agreement.

11. Definitions

·"Customer Data" means any data (a) provided by Customer, or any user of the Services, including via any products and services provided by Customer, to Twilio in connection with Customer's use of the Services or (b) generated for Customer's use as part of the Services.

·"Segment Services" means any services or application programming interfaces branded as "Segment", "Twilio Segment", or "Twilio Engage".

·"SendGrid Services" means any services or application programming interfaces branded as "SendGrid" or "Twilio SendGrid".

·"Services" means, collectively, the Twilio Services (as defined below), SendGrid Services, and Segment Services.

·"Twilio Services" means any (a) services or application programming interfaces branded as "Twilio" and (b) cloud-based identity, authentication, and security platform, and related services, branded as "Stytch".

22. Purpose. This Security Overview describes Twilio's security program, including Twilio's security certifications and self-attestations and technical and organizational security controls to protect (a) Customer Data from unauthorized use, access, disclosure, or theft and (b) the Services. As security threats change over time, Twilio continues to update its security program and strategy to protect Customer Data and the Services in accordance with industry best practices. As such, Twilio reserves the right to update this Security Overview from time to time; provided, however, any update will not materially reduce the overall protections set forth in this Security Overview. The then-current terms of this Security Overview are available at https://www.twilio.com/legal/security-overview. This Security Overview does not apply to any (a) Services that are identified as alpha, beta, not generally available, limited release, developer preview, or any similar Services offered by Twilio or (b) any services provided by telecommunications providers.

33. Security Organization and Program. Twilio maintains a risk-based assessment security program based on the ISO / IEC 27001 Information Security Management System (ISMS), which includes administrative, technical, organizational, and physical safeguards reasonably designed to protect the Services and the security, confidentiality, integrity, and availability of Customer Data. Twilio's security program is intended to be appropriate to the nature of the Services and the size and complexity of Twilio's business operations. Twilio has separate and dedicated Information Security teams that manage Twilio's security program, including those that facilitate and support independent audits and assessments performed by third parties. Twilio's security program is managed at the highest levels of the company, with Twilio's Chief Information Security Officer regularly meeting with executive management to discuss security-related issues and coordinate company-wide security initiatives. Twilio's information security policies and standards are reviewed and approved by Twilio's executive management at least annually.

44. People Security and Onboarding. Twilio (a) maintains comprehensive policies, procedures, and controls that are regularly updated to align with industry best practices and (b) makes such policies and procedures readily accessible to all Twilio employees. All Twilio employees are subject to the following minimum security measures:

·(i) Performance of a background check that is administered by a recognized third-party background check provider on all new Twilio employees prior to hiring in accordance with applicable local laws, including education and employment verification and reference checks, and where permitted by local law and applicable to the job role, criminal, credit, and right-to-work verification;

·(ii) Execution of a confidentiality agreement;

·(iii) Annual completion of mandatory security and privacy training, with extended deadlines available for Twilio employees on leaves of absence;

·(iv) Maintenance and continuous monitoring of an anonymous hotline for Twilio employees to report any unethical behavior where anonymous reporting is legally permitted;

·(v) Raising awareness of emerging security threats through various mediums, including simulated security-related incidents (e.g. phishing campaigns); and

·(vi) Controlled and limited access of Customer Data strictly to authorized Twilio employees only in accordance with Section 10.1 (Provisioning Access) and Twilio's internal standard operating procedures governing such Customer Data's processing and protection.

55. Physical Security. Twilio maintains strong physical security controls at its offices, which are guided by a physical security policy that is regularly reviewed. Twilio's physical security policy establishes baseline physical security controls necessary for preventing unauthorized access to Twilio's offices and for the safeguarding of Twilio's physical assets. Twilio's physical security policy covers areas such as access controls, employee and contractor badge requirements, securing IT equipment, and after hours monitoring. Twilio requires its infrastructure providers identified in Section 8 (Hosting Architecture and Data Segregation) of this Security Overview to maintain physical security standards that are at a minimum, aligned with SOC 2 standards.

66. Third-Party Vendor Management. Twilio may use third-party vendors to provide the Services. Twilio has implemented a comprehensive vendor management program that applies the appropriate technical and organizational security controls that is proportional to the type of service the third-party vendor is providing and any associated security-related risks. Prospective third-party vendors are thoroughly vetted through a process that ensures they comply with, and will continue to comply with, Twilio's rigorous confidentiality, security, and privacy requirements for the duration of their relationship with Twilio. Third-party vendors that process Customer Data are subject to more stringent technical and organizational security controls which are (a) reflected in Twilio's contractual agreement with such third-party vendors and (b) regularly audited by Twilio to assure continued compliance. In addition, Twilio regularly reviews (i) each third-party vendor against Twilio's security and business continuity standards; (ii) each third-party vendor's access to Customer Data and its technical and organizational security controls to protect Customer Data; and (iii) evolving legal or regulatory requirements that impact Twilio's security program or processing of Customer Data. Twilio's current third-party vendors that are sub-processors are available at https://www.twilio.com/en-us/legal/sub-processors. For the avoidance of doubt, telecommunication providers are not considered third-party vendors or sub-processors of Twilio.

77. Security Certifications and Attestations. Twilio holds the following security-related certifications and attestations:

·For additional information relating to Twilio's security certifications and attestations and other-related security documentation, please visit the applicable Trust Center below:

• ·Trust Center for the Twilio Services and SendGrid Services: https://security.twilio.com
• ·Trust Center for the Segment Services: https://security.segment.com

88. Hosting Architecture and Data Segregation

8.18.1 Infrastructure and Colocation Providers. The specific Services set forth below are hosted by the applicable industry-leading infrastructure or colocation provider. Information regarding the infrastructure and colocation providers technical and organizational security controls is also available below.

8.28.2 Production Environment and Customer Data Access. The production environment of the Services that are hosted with the aforementioned infrastructure providers are logically isolated in a Virtual Private Cloud (VPC), and Customer Data is encrypted at all times. The infrastructure providers are hosted in the United States of America. The aforementioned infrastructure and colocation providers do not have access to unencrypted Customer Data. All network access between hosts within the production environment is restricted, using access control mechanisms and the principle of least privilege to allow only authorized services to interact within the production environment. Access control lists are in use to manage network segregation between different security zones in the production and corporate environments within Twilio's hosting environment. Access control lists are reviewed regularly. Twilio separates Customer Data using logical identifiers. Customer Data is tagged with a unique customer identifier that is assigned to segregate Customer Data ownership. Twilio's application programming interfaces are designed and built to identify and allow authorized access only to and from Customer Data identified with customer-specific tags. These controls prevent other customers from having access to Customer Data.

99. Security by Design. Twilio follows security by design principles when it designs the Services. Twilio also applies the Twilio Secure Software Development Lifecycle (Secure SDLC) standard to perform numerous security-related activities for the Services across different phases of the product creation lifecycle, from requirements gathering and product design all the way through product deployment. These activities include, but are not limited to, the performance of (a) internal security reviews before deploying new Services or code; (b) penetration tests of new Services; and (c) threat models for new Services to detect potential security threats and vulnerabilities.

1010. Access Controls

10.110.1 Provisioning Access. Twilio follows the principles of least privilege through a team-based access control mechanism when provisioning system access to minimize the risk of unauthorized Customer Data exposure. Twilio employees' access to Customer Data must be approved before it is granted and is restricted based on if their job role or job responsibilities specifically require it. Access rights to the production environment of the Services that are not time-based are reviewed at least quarterly. An employee's or contractor's access to Customer Data is promptly removed upon termination of employment. In order to access the production environment of the Services, an authorized user must have a unique username and password and multi-factor authentication enabled. Before an authorized user is granted access to the production environment of the Services, access must be approved by management. Additionally, the authorized user is required to complete internal training for such access, including training on the proper use of the relevant systems that interface with or permit access to the production environment of the Services. Twilio logs high risk actions and changes in the production environment of the Services. Twilio leverages automation to identify any deviation from internal technical standards that could indicate anomalous and/or unauthorized activity to raise an alert within minutes of a configuration change.

10.210.2 Password Controls. At a minimum, Twilio's password management policy for Twilio employees follows the NIST 800-63B guidance and requires the use of longer character lengths, special characters, and multi-factor authentication. Additionally, when a customer logs into its account, Twilio hashes the credentials of the user before it is stored. A customer must also require its users to add another layer of security to their account by using two-factor authentication (2FA).

1111. Change Management. Twilio has a formal change management process it follows to administer changes to the production environment of the Services, including any changes to its underlying software, applications, and systems. Each change is carefully reviewed and evaluated in a test environment before being deployed into the production environment of the Services. All changes, including the evaluation of the changes in a test environment, are documented using a formal, auditable system of record. A rigorous assessment is carried out for all high-risk changes to evaluate their impact on the overall security of the Services. Deployment approval for high-risk changes is required from the correct organizational stakeholders. Plans and procedures are also implemented in the event a deployed change needs to be rolled back to preserve the security of the Services.

1212. Encryption

12.112.1 Encryption in Transit. Customer Data is encrypted when in transit between Customer's software application and the Services using TLS v1.2. Additionally, for the SendGrid Services, Twilio provides opportunistic TLS v1.1 or higher for emails in transit between Customer's software application and the recipient's email server. The SendGrid Services are designed to opportunistically try outbound TLS v1.1 or higher when attempting to deliver an email to a recipient. This means that if a recipient's email server accepts an inbound TLS v1.1 or higher connection, Twilio will deliver an email over a TLS encrypted connection. If a recipient's email server does not support TLS, Twilio will deliver an email over the default unencrypted connection. The SendGrid Services provide an optional feature, which Customer has to enable, that allows Customer to enforce TLS encryption. If Customer enables the enforced TLS feature, Twilio will only deliver an email to a recipient if the recipient's email server accepts an inbound TLS v1.1 or higher connection. More information regarding enabling the enforced TLS feature for the SendGrid Services is available at https://www.twilio.com/docs/sendgrid/api-reference/settings-enforced-tls/update-enforced-tls-settings.

12.212.2 Encryption at Rest. Customer Data is encrypted at rest in AWS and GCP using the Advanced Encryption Standard.

1313. Vulnerability Management. Twilio maintains controls and policies to mitigate the risk of security vulnerabilities in a measurable time frame that balances risk and the business and operational requirements. Twilio uses third-party tooling to conduct vulnerability scans regularly to assess vulnerabilities in Twilio's hosting environment and corporate systems. Critical software patches are evaluated, tested, and applied proactively. Operating system patches are applied through the regeneration of a base virtual-machine image and deployed to all nodes in the Twilio cluster over a predefined schedule. For high-risk patches, Twilio will deploy directly to existing nodes through internally developed orchestration tools.

1414. Penetration Testing. Twilio performs penetration tests on a regular basis. Security threats and vulnerabilities that are detected are prioritized, triaged, and remediated promptly. Additionally, Twilio maintains a Bug Bounty Program through HackerOne, which allows independent security researchers to report security threats and vulnerabilities on an ongoing basis.

1515. Security Incident Management

15.115.1 Prevention Measures. Twilio maintains security incident management policies and procedures in accordance with NIST SP 800-61. Twilio's Security Incident Response Team (T-SIRT) assesses relevant security threats and vulnerabilities and establishes appropriate remediation and mitigation actions. Twilio retains security logs for one hundred and eighty (180) days. Access to these security logs is limited to T-SIRT. Twilio utilizes third-party tools to detect, mitigate, and prevent Distributed Denial of Service (DDoS) attacks.

15.215.2 Incident Response. Twilio will promptly investigate a Security Incident upon discovery (as defined in the Agreement). To the extent permitted by applicable law or regulation, Twilio will notify Customer of a Security Incident in accordance with the Agreement. Security Incident notifications will be provided to Customer via email to the email address designated by Customer in its account. Twilio has a defined set of policies, procedures, standards, and tooling that guide its subsequent responses, with adherence to applicable law or regulation. This includes customer notifications where mandated, coordination with law enforcement, and declarations to applicable privacy and other regulatory bodies where appropriate.

1616. Resilience and Service Continuity

16.116.1 Resilience. Twilio utilizes multiple geographically diverse regions within its infrastructure providers and has configured multiple fault-independent availability zones within each of those regions to ensure that a failure in any single data center does not affect the availability of the Services. This allows Twilio to detect and route around issues experienced by hosts or even whole data centers in real time and employ orchestration tooling that is able to regenerate hosts, building them from the latest backup.

16.216.2 Service Continuity. Twilio leverages specialized tools available within the hosting infrastructure of the Services to monitor server performance, data, and traffic load capacity within each availability zone and colocation data center. If suboptimal server performance or overloaded capacity is detected on a server within an availability zone or colocation data center, these specialized tools increase the capacity or shift traffic to relieve any suboptimal server performance or capacity overload. Twilio is also immediately notified in the event of any suboptimal server performance or overloaded capacity.

1717. Customer Data Backups. Twilio performs regular backups of Customer Data, which is hosted on AWS's data center infrastructure. Customer Data that is backed up is retained redundantly across multiple availability zones and encrypted in transit and at rest using a modern encryption standard based on the type of Customer Data being encrypted.

·Print this page

·Customer and Partner Agreements An icon of a down chevron

·Privacy An icon of a down chevron

·Mobile Application Terms An icon of a down chevron Twilio Frontline End User App Terms Twilio Authy App Terms

·Supplier Agreements An icon of a down chevron Supplier Purchase Order Terms and Conditions Country-Specific Terms Supplier Data Protection Addendum Supplier Code of Conduct

·Intellectual Property An icon of a down chevron DMCA Policy Trademark

·Resources for Law Enforcement An icon of a down chevron Government Requests Transparency Report

·Civil Requests An icon of a down chevron Submit a request or subpoena

·Code of Conduct & Ethics Hotline An icon of a down chevron Twilio Code of Conduct Ethics and Whistleblower Hotline Discord Community Code of Conduct Twilio Discord FAQ

·Digital Promotions General Rules An icon of a down chevron Sweepstakes Rules

·Customer Research and User Experience An icon of a down chevron Acknowledgement and Waiver

·Twilio Authy Application Terms

·Last Updated: February 23, 2026

·By using, installing, or accessing the Twilio Authy Application ("Authy App"), or clicking to accept the terms set forth in these Twilio Authy Application Terms ("Authy App Terms"), you agree to be bound by these Authy App Terms. For purposes of these Authy App Terms, Any references to "you" or "your" refer to you as the user of the Authy App, and any references to "Twilio" refer to Twilio Inc.

11. Use of the Authy App. You will use the Authy App in accordance with these Authy App Terms, the Twilio Acceptable Use Policy, and applicable law or regulation.

22. IP Rights and Licenses. Twilio owns all right, title, and interest in and to the Authy App. Subject to your compliance with the terms of these Authy App Terms, Twilio grants you a limited, non-exclusive, non-transferable license to install and use one (1) object code copy of the Authy App.

33. Data Privacy and Acknowledgement of Use

·(a) Data Processing. Any data, including your personal information, collected, transmitted, stored, or otherwise processed through your use of the Authy App will be processed in accordance with the Twilio Privacy Notice.

·(b) Additional Fraud Prevention and Security Measures. On or after February 23, 2026, if you are (i) a new Authy App user or (ii) an existing Authy App user that has downloaded the Authy App to an additional device or reinstalls the Authy App on the same device, Twilio will process the following additional data types in accordance with the Twilio Privacy Notice for the purposes of preventing fraud and enhancing account security: Device ID

• ·Device information including, without limitation, model of mobile device, VPN, remote access, and rooted status Location based on IP address

·These additional data types may be collected by or transmitted to Stytch for further processing and evaluation to prevent fraud and enhance account security.

·If you are an existing Authy App user prior to February 23, 2026, and you do not take the actions set forth in Section 3(b)(ii) of these Authy App Terms, the Stytch software development kits will be present on your existing device, but they will not collect these additional data types.

44. Availability of the Authy App. You understand that use and availability of the Authy App may be interrupted, including for maintenance, upgrades, or network or equipment failures. Twilio may discontinue the Authy App, any of its features, and/or support for the Authy App, including its use on certain devices and platforms, at any time.

55. Feedback. Twilio welcomes any recommendations, suggestions, ideas, or feedback you have about the Authy App (collectively, "Feedback"). You understand that Twilio owns all Feedback that you provide, and you are not entitled to any compensation or reimbursement of any kind for providing Feedback to Twilio or in connection with Twilio's use of Feedback.

66. Terms Applicable to Authy App Use on iOS Devices. This Section 6 only applies to the extent you are using the Authy App on an iOS device. You acknowledge that these Authy App Terms are between you and Twilio only, not with Apple Inc. ("Apple"), and Apple is not responsible for the Authy App or the content thereof. Apple has no obligation to furnish any maintenance and support services with respect to the Authy App. If the Authy App fails to conform to any applicable warranty, you may notify Apple and Apple will refund any applicable purchase price for the Authy App to you; and, to the maximum extent permitted by applicable law, Apple has no other warranty obligation with respect to the Authy App. Apple is not responsible for addressing any claims by you or any third party relating to the Authy App or your possession and/or use of the Authy App, including: (a) product liability claims; (b) any claim that the Authy App fails to conform to any applicable legal or regulatory requirement; or (c) claims arising under consumer protection or similar legislation. Apple is not responsible for the investigation, defense, settlement, and discharge of any third-party claim that the Authy App and/or your possession and use of the Authy App infringe a third party's intellectual property rights. You agree to comply with any applicable third-party terms when using the Authy App. Apple and Apple's subsidiaries are third-party beneficiaries of these Authy App Terms, and upon your acceptance of these Authy App Terms, Apple will have the right (and will be deemed to have accepted the right) to enforce these Authy App Terms against you as a third-party beneficiary of these Authy App Terms. You hereby represent and warrant that: (i) you are not located in a country that is subject to a U.S. Government embargo, or that is on Title 15, Part 740 Supplement 1 Country Group E of the U.S. Code of Federal Regulations and (ii) you are not listed on any U.S. Government list of prohibited or restricted parties.

77. Warranty Disclaimer. THE AUTHY APP IS PROVIDED "AS IS," AND TWILIO MAKES NO WARRANTY OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, AND TWILIO SPECIFICALLY DISCLAIMS ALL IMPLIED WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT TO THE FULLEST EXTENT PERMITTED BY LAW.

88. Indemnification. You will defend Twilio and Twilio's officers, directors, employees, and affiliated entities (collectively, "Twilio Indemnified Parties") from and against any claim, demand, suit, or proceeding made or brought against a Twilio Indemnified Party by a third party alleging or arising out of your use of the Authy App ("Claim"). You will indemnify Twilio from any damages, fines or penalties imposed by a government or regulatory body, attorneys' fees, and costs awarded against a Twilio Indemnified Party or for settlement amounts approved by you for a Claim.

·Twilio reserves the right, at its own expense, to participate in the defense of any Claim. You will not do the following without Twilio's prior written consent: (a) settle any Claims for which you have an obligation to indemnify pursuant to this Section 8 or (b) admit to liability or fault or create any obligation on behalf of Twilio as part of a settlement of a Claim.

99. Limitation of Liability. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THESE AUTHY APP TERMS, TWILIO'S AGGREGATE LIABILITY TO YOU OR ANY THIRD PARTY ARISING OUT OF THESE AUTHY APP TERMS OR OTHERWISE IN CONNECTION WITH THE AUTHY APP WILL IN NO EVENT EXCEED FIFTY DOLLARS ($50.00). YOU ACKNOWLEDGE AND AGREE THAT THE ESSENTIAL PURPOSE OF THIS SECTION 9 IS TO ALLOCATE THE RISKS UNDER THESE AUTHY APP TERMS BETWEEN THE PARTIES, AND TWILIO HAS RELIED ON THESE LIMITATIONS IN DETERMINING WHETHER TO PROVIDE YOU THE RIGHTS TO ACCESS AND USE THE AUTHY APP.

1010. Term and Termination. These Authy App Terms will commence on the date you begin using, installing, or accessing the Authy App or click to accept these Authy App Terms, and will continue until terminated in accordance with this Section 10.

·You may terminate these Authy App Terms at any time, for any or no reason, by immediately ceasing your use of the Authy App. If you commence using the Authy App again, you are consenting to, and will comply with, these Authy App Terms. Twilio may, in its sole discretion, suspend or terminate these Authy App Terms immediately (a) if Twilio suspects you are in breach of these Authy App Terms; (b) if Twilio determines that you are engaged in activity that is suspected or actually fraudulent, illegal, or otherwise malicious or fails to comply with applicable law or regulation; (c) causes a significant risk of reputational harm to Twilio; or (d) to prevent harm to the security, stability, availability, or integrity of the Authy App.

1111. Modification. Twilio may update these Authy App Terms from time to time. Twilio will provide you with written notice of any material updates at least thirty (30) days prior to the date the updated version becomes effective, unless such material updates result from changes in laws, regulations, or requirements from telecommunications providers. All notices to you will be provided via email to the email address you used to register for the Authy App. Following such notice, your continued use of the Authy App on or after the date the updated version of these Authy App Terms becomes effective constitutes your automatic acceptance of the updated version of these Authy App Terms. The updated version of these Authy App Terms supersedes all prior versions. If you do not agree to the updated version of these Authy App Terms, you must stop using the Authy App.