> For the complete documentation index, see [llms.txt](https://docs.limephone.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.limephone.io/workspace/security-and-trust.md).

# Security and trust

Practical steps to keep your LimePhone workspace, API keys, and call data secure.

## How sign-in works

You sign in to <https://dashboard.limephone.io> with your email address and password. Use a strong, unique password — ideally generated and stored by a password manager. If you believe your password has been exposed, change it right away in Settings → Account Settings and contact <support@limephone.io> if you see activity you don't recognize.

## Roles and least privilege

Every member of your workspace has a role — owner, admin, member, or viewer — and each role can do progressively less. Give people the lowest role that still lets them do their job: a teammate who only reviews Call Logs doesn't need admin. Review your member list periodically in Settings → Members and remove anyone who has left the team.

See [Members and roles](https://docs.limephone.io/workspace/members-and-roles) for what each role can do.

## API key hygiene

API keys created in Settings → API Keys carry full access to your workspace's API, so treat them like passwords:

1. **Scope them.** Grant each key only the scopes it needs (for example, read-only scopes for a reporting integration) instead of admin access.
2. **Restrict by IP.** Add an IP allowlist to a key so it only works from your servers, even if it leaks.
3. **Set an expiry.** Give keys an expiration date and rotate them on a schedule.
4. **Never expose keys client-side.** Keep secret keys on your server; never commit them to source control or ship them in a browser or mobile app.
5. **Revoke unused keys.** Delete keys for integrations you no longer run.

## Verify webhooks

If you receive webhooks from LimePhone, verify the signature on every delivery before trusting the payload. This proves the request really came from LimePhone and wasn't tampered with. See the [webhooks reference](https://docs.limephone.io/api-reference/webhooks) for how signing works.

## Call recording and consent

Call-recording laws differ by country and, in the US, by state — some jurisdictions require one party's consent, others require all parties to consent. Before enabling recording, check the rules that apply where you and your callers are located, and announce recording where required. This is general guidance, not legal advice; consult a lawyer for your specific situation.

## Carrier compliance

Messaging carriers enforce their own trust requirements. In the US, SMS from local numbers requires 10DLC registration — unregistered traffic is filtered by carriers. Register your brand and campaigns in Settings → Trust center, which also covers regulatory addresses and bundles required for numbers in some countries. See [Trust center](https://docs.limephone.io/workspace/trust-center-10dlc-and-compliance) for the full walkthrough.

## Reporting a security issue

If you find a vulnerability or notice suspicious behavior on your account, email **<support@limephone.io>** with the details — what you found, how to reproduce it, and any relevant timestamps. Please don't test against other customers' data. We'll acknowledge your report and follow up as we investigate.