The Twilio Customer Engagement Platform is built on the foundation of the company’s developer-first ethos, which dates to the company’s founding in 2008. From day one, we’ve grown due to our relentless focus on building tools that enable developers every step of the way. Each facet of Twilio’s platform—from our API-first approach, to SDKs, serverless tools, best-in-class documentation, and more—has been tailored to provide a trusted experience that developers not only prefer to build with, but one that they love.

We’re not done, either. As the world’s most innovative customer communications platform, Twilio continues to enhance its ecosystem and deliver powerful new features to support a richer development environment. When you build on Twilio, you’re choosing the platform you can trust to drive efficient, best-in-class experiences for your developers and customers alike for decades to come.

Channel APIs

Channel proliferation continues to expand as digital transformation accelerates across industries. With Twilio’s vast breadth of channel APIs, businesses are fully prepared to bridge communication gaps across every critical channel—today, and well into the future. 

Developers are free to take control and accelerate time to market, managing all of their communication channels through a single platform—from SMS and Email, to Voice, WhatsApp, Push and (a lot) more. Both developers and business stakeholders can assess performance across their channels with centralized insights that enable you to understand what’s working and quickly take action as necessary. You can explore all of Twilio’s products here!

SDKs

The Twilio customer engagement platform offers developers both server-side and client-side SDKs to support their workflows. Twilio’s server-side SDKs—available in all of the most popular server-side languages, like C#, Java, Node.js, PHP, Python and Ruby—make it easy for you to use Twilio’s REST APIs, generate TwiML, and perform other common server-side programming tasks.

On the client side, Twilio’s JavaScript, iOS, Android and Flex SDKs enable you to create video conversations, initiate VoIP calls, implement real-time chat, and more— whether in a browser, on a device or in a contact center.

As the Twilio platform has developed and new products have been introduced, our API surface has grown too. When it comes to libraries, that kind of development could result in a disconnect, resulting in “API drift.” Not with Twilio. With the help of some automation (and a few layers of manual optimization), Twilio’s helper libraries are auto-generated every two weeks. Our use of CI/CD workflows means that you can trust Twilio to continually improve our libraries at scale, while always benefiting from the most up-to-date functionality available.

Serverless Tools

Build, deploy, and operate powerful apps at scale without having to manage servers or constantly monitor scale. Twilio Runtime is a suite of serverless tools—built by developers, for developers—supporting every step of the development process. Runtime includes Twilio CLI, helper libraries, API keys, debugging tools, a powerful visual workflow designer called Studio, and a serverless hosting environment for Node.js code and static assets called Twilio Functions.

Services

Building a completely secure communications solution for your business requires far more than reliable and scalable channel APIs and the tools to implement them. It demands services such as identity management, authentication, secure and compliant payments, privacy controls like number-masking, and more. With so many development teams needing to implement these kinds of services, while providing global availability and Enterprise-level scalability, why reinvent the wheel?

Accelerate your time to market and implement years of best practices in just minutes with powerful services provided by Twilio, which have been expertly designed to handle the most common communications use cases.

We deliver services with the level of security, reliability, and scale that the world’s most trusted brands expect from us.

• Identity: Whether you need to interpret important data and context for who’s behind every conversation—things like origin, line, and carrier type, or even caller name and type—or take steps to future-proof yourself (and your customers) from fraudulent account creation and transactions, Twilio’s Lookup, Verify and Authy services help ensure that trust and verification is built into every aspect of your communications flow.
• Intelligence: Individualized customer interactions can get complicated quickly. As the ability to handle growing demand at scale becomes critical, Twilio can enable your business (and team) to scale with intelligent tools such as AI chatbots featuring Autopilot and Twilio Conversations—a single API to manage scalable, multi-party conversations across channels.
• Orchestration: Seeing the big picture is critical to ensuring that each and every customer interaction is handled efficiently. Sometimes this means connecting a customer with the most skilled agent to meet their unique needs. Building a system with intelligent routing at scale requires a lot of code to implement and maintain. With Twilio, you can design and deploy seamless communication workflows across the platform with visual, drag-and-drop builders like Studio. When a human touch is needed, TaskRouter’s programmatic, skills-based routing sets up your frontline team for success, while ensuring that each customer is placed into the right agent’s hands each and every time.

Built on Amazon Web Services (AWS), Twilio utilizes AWS services as well as third party systems for operational alerting, performance monitoring, log aggregation, configuration monitoring and process automation. Twilio leverages a microservices architecture that expands and contracts based on resource requirements.

We help customers architect for capacity and scale with downstream providers by designing for solutions factors such as capacity, throughput, performance and quality. Twilio will provide best practices and recommend specific configurations in order to meet the expected goals in performance and quality. These decisions are driven by Risk, Business & Privacy Impact analysis methodologies.

The Twilio Super Network provides the engine needed to deliver communications globally, managing partner carrier relationships, aggregation services and compliance needs. Twilio takes a proactive approach to routing, by optimizing routes and spotting potential carrier outages before they impact your customers. We have 12 years of experience developing and enhancing unique internal tools that monitor hundreds of millions of data points per day in order to identify fine-tuned routing optimizations that maximize quality. Twilio’s service availability and the status of global telecom carriers is available here:

• Twilio Service Availability

Twilio employs a network based intrusion detection system (IDS) provided by AWS GuardDuty. Amazon GuardDuty analyzes AWS CloudTrail, VPC Flow Logs, and AWS DNS logs. The service is optimized to consume large volumes of data for near real-time processing of security detections. It uses threat intelligence feeds, such as lists of malicious IPs and domains, and machine learning to identify unexpected and potentially unauthorized and malicious activity within the Twilio AWS environment.

Twilio logs high risk actions and changes in the production network. We leverage automation to identify any deviation from our technical standards and raise issues within minutes of if a configuration change occurs. Twilio also logs user attempts to authenticate to the production environment (both successful and unsuccessful attempts).

Security logs are aggregated within a log aggregation platform and retained for 180 days (90 days hot, 90 days cold). Access to these security logs is limited to the Twilio Security Incident Response and Monitoring team. We consolidate security logs from Twilio devices and AWS and monitor them in a centralized system in SumoLogic, and are time-synced with NIST servers.

Leveraging the internal tooling work described above in “Operations & Monitoring”, a powerful set of self-service external reporting and analytics tools have been released that utilize thousands of monitors at the carrier and customer edges to provide insight to how services perform for their configured services.

Customers have provided feedback that their reporting requirements differ based on the channel and use cases that they deploy. To meet the unique reporting needs of our customers, Twilio has released the Insights tool suite (with more tools planned). These tools provide customers with GUI driven analytics and dashboards, in addition to the existing API access that customers have, that allows them to scrape log data and store it in their own data lake. Three examples of the Insights analytics tools are described below:

• Twilio Voice Insights
• Twilio Messaging Insights
• Twilio Flex Insights

Super Network

The result of more than a decade of partnership with over 1,500 global carriers, Twilio’s Super Network abstracts the deep complexity of sending communications to billions of people worldwide while offering levels of redundancy, reliability, and security that no other provider currently offers.

Greater than the sum of its parts, the Super Network uses more than 8,000 network monitors and 800 million data points to detect 98% of incidents before customers do—and 95% of incidents prior to detection by the carriers. The Super Network boasts an average route depth of 4 providers and it is constantly optimizing downstream capacity for 50% utilization levels. Twilio actively measures voice quality on every route within the Super Network in real time, changing route traffic as necessary to consistently deliver the highest quality for you and your customers.

From the world’s largest public companies to early-stage startups, customers rely on Twilio’s platform to exchange millions of communications every day, supporting myriad applications. These communications facilitate deliveries, power customer support, and keep mission-critical applications running 24x7x365. Providing a reliable infrastructure is only the first step. These systems must follow the latest security best practices and comply with strict privacy regulations and corporate policies.

While security is a high priority for all teams, a dedicated Security Team manages Twilio’s security program. The Twilio security framework is based on the ISO 27001 Information Security Standard and includes programs that cover security on a company-wide basis. Twilio’s security is represented at the highest levels of the company, with our Chief Information Security Officer meeting with executive management regularly to discuss issues and coordinate company-wide initiatives. Information security policies and standards are approved by management and are available to all Twilio employees.

Below, you’ll find valuable information on key components of Twilio’s security practices. For a deep-dive, please refer to the Twilio Cloud Communications Security Whitepaper which details our complete Security Program and covers policies and procedures, asset and access management, cryptography, physical and operations security, communications and business continuity security, people and product security, cloud and network infrastructure security, compliance, third-party security, and vulnerability management, as well as security monitoring and incident response.

Compliance Certifications

ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018

As part of our information security management system, Twilio is certified under ISO/IEC 27001, a management system that provides specific requirements and practices intended to bring information security under management control. In addition, we have attestations to ISO/IEC 27017 and ISO/IEC 27018—internationally recognized codes of practice that provide guidance on controls to address cloudspecific information security threats and risks, as well as for the protection of personally identifiable information (PII). See Twilio’s ISO/IEC Certifications Documentation for details on our compliance with these standards.

Cloud Security Alliance

Twilio is a member of the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining and raising awareness of best practices to help ensure a secure cloud computing environment. Twilio’s Cloud Security Alliance listing and consensus assessment is available publicly.

CSA operates the most popular cloud security provider certification program, the CSA Security, Trust & Assurance Registry (STAR), a three-tiered provider assurance program of self-assessment, third-party audit and continuous monitoring. CSA also manages the CSA Global Consulting Program, a professional program that allows cloud users to work with a network of trusted security professionals and organizations that offer qualified professional services based on CSA best practices.

HIPAA Eligibility

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996 as part of a larger healthcare reform package in the United States. Twilio’s HIPAA eligibility is another milestone for the company in elevating our data privacy and security standards to meet the needs of our customers who are subject to HIPAA regulations.

Twilio customers that rely on our platform to process protected health information (PHI) on their behalf must execute Twilio’s Business Associate Addendum (BAA). Twilio’s BAA has been developed to account for the specific products and services that our customer engagement platform offers. We operate on what is commonly referred to amongst cloud infrastructure providers as the “shared responsibility model” to help enable our customers to comply with their HIPAA obligations. Additional details regarding Twilio’s HIPAA eligibility can be found at twilio.com/ hipaa, and by speaking with your Twilio sales or account representative.

PCI for Voice

Twilio’s Programmable Voice product enables developers to build fully customizable payment solutions on a secure, trusted platform. Programmable Voice is Payment Card Industry Data Security Standard (PCI DSS) Level 1 compliant—the most rigorous certification level available.

Whether you’re PCI compliant or building an app that requires PCI compliance, you can rely on Twilio to accept payments securely and reliably. The latest details on Twilio’s PCI compliance are available at twilio.com/pci-compliance.

SOC 2 Compliance

Twilio’s Authy and SendGrid offerings are SOC 2 Type 2 compliant, with Twilio Programmable Voice SOC 2 Type 1 compliant. Detailed reports on these products’ compliance standards are available to eligible customers, upon request.

Customer Agreements

For your convenience, Twilio’s standard agreements for our Terms of Service, Acceptable Use Policy and Service Level Agreement can be found at the links below:

• Terms of Service
• Acceptable Use Policy
• SLA

Data Privacy

Privacy and the protection of customer data is core to Twilio’s mission of being the world’s most trusted customer engagement platform. Twilio’s privacy program is founded on our Binding Corporate Rules. Our team is always more than happy to discuss specific questions about Twilio’s privacy program, but for your convenience, some of the most common and helpful links can be found below: 

• Privacy Statement
• Data Protection Addendum
• GDPR
• Privacy Shield
• CCPA
• Sub-Processors