Skip to main content
MultiMFA logoMultiMFA
← Back to Main Page

SMS Data Retention & Deletion

Effective Date: March 30, 2026

This policy describes how MultiMFA, Inc. ("MultiMFA", "we", "us") retains and deletes SMS-related data for MultiMFA SMS and MultiMFA SMS (Cell) (including shared verification numbers, cellular receiving numbers when that service is offered, relay delivery, and activity shown in your dashboard). MultiMFA SMS and MultiMFA SMS (Cell) use MultiMFA's SMS retention controls. It supplements our Privacy Policy. If anything here conflicts with a signed agreement you have with us, the agreement controls.

1. What this covers

For purposes of this policy, SMS-related data includes:

  • Incoming SMS records: Messages received on MultiMFA numbers (which typically include short-lived verification codes), together with routing fields such as originating and destination numbers and receipt timestamps.
  • Outgoing SMS records: Messages we send on your behalf (for example to relay users), including content, destination, originating number, send time, delivery status, and related operational fields.
  • Activity / usage logs tied to SMS: Records we maintain for dashboard history and troubleshooting that reference SMS traffic (for example summaries or events associated with a phone number).

Verification codes are usually valid only briefly; even so, the message text may be storedso you can see delivery and activity in the product. This policy uses "SMS metadata" broadly to include those records, not only technical headers.

2. Why we retain SMS-related data

  • To operate the service (receive, display, and relay verification messages).
  • To show accurate history and activity in your account.
  • To diagnose delivery issues, abuse, billing disputes, and support requests.
  • To meet legal, security, and compliance obligations where applicable.

Why would anyone delete or shorten retention if the codes already expired? From a pure authentication standpoint, a one-time code is usually useless after seconds or minutes. Organizations still ask for deletion or minimization for other reasons: data minimization policies (fewer fields stored means less to protect or disclose), narrowing the scope of breaches and e-discovery, aligning with vendor risk questionnaires that treat "message content" as sensitive even when it is not reusable, and internal rules that apply to any retained communications—not whether the OTP still works. None of that means every customer needs stricter deletion; many teams value a full dashboard trail for support and audits.

3. Retention periods (default)

While your MultiMFA number (or trial number) remains on your account and the service is in use, we generally retain SMS-related data described in Section 1 for as long as needed for the purposes in Section 2. We do not use SMS content for advertising or resale.

When a MultiMFA number is released, removed, or otherwise ended (for example after cancellation, trial end, or administrative release of the number), we delete associated SMS-related records in our primary application database as part of that workflow, subject to Section 6 (backups and legal holds).

When your account is closed or deleted in accordance with our processes, we delete or disassociate personal account data and remove SMS-related logs tied to your numbers as part of that closure, subject to the same limitations in Section 6.

We may introduce additional automated time-based deletion of entire log rows (not only redaction of message bodies) as our product and compliance posture evolve. If we do, we will update this page and the effective date.

Account preference: SMS body redaction

In your account Profile settings (dashboard → Settings → Profile), you can choose how MultiMFA treats the text body of SMS messages for phone numbers assigned to your user account:

  • Keep full SMS text (default): Message bodies remain stored and visible in your history while the number exists and subject to the rest of this policy.
  • Redact after 24 hours: For your numbers, incoming and outgoing SMS message bodies older than 24 hours are replaced in our application database with a fixed placeholder. Timestamps, from/to numbers, and delivery status generally remain for troubleshooting.
  • Redact after 7 days: Same as above, using a seven-day window.

Redaction is applied by an automated job that runs on a schedule (typically at least hourly) and is also enforced when you load usage history in the product, so eligible bodies are not shown even between job runs. Redaction is not reversible:if you later switch back to "keep full," text that was already replaced cannot be recovered from MultiMFA.

This preference applies to your assigned numbers and related logs in MultiMFA. It does not control what independent messaging carriers or providers retain under their own policies.

4. Deletion and your requests

You may request deletion of your account and associated data, or ask questions about specific SMS-related retention, by contacting [email protected]. We will respond in line with applicable law and operational feasibility. Some requests may require verifying your identity or ownership of the account.

Deleting SMS-related data may reduce or remove message history visible in the dashboard. Deleting a number or account may be irreversible where numbers have been released to carriers or providers.

5. Messaging providers and carriers

SMS traffic passes through third-party messaging providers and mobile networks. Those parties may log message content, numbers, and timestamps under their own policies and legal requirements. We do not control their retention schedules. For subprocessors we use to deliver the service, see disclosures in our Privacy Policy.

6. Backups, security, and legal holds

  • Backups: Deleted data may persist for a limited time in encrypted backups until those backups expire according to our backup rotation. Restores are performed only for disaster recovery or integrity needs, not routine access to deleted records.
  • Legal and safety: We may retain information longer where required by law, regulation, valid legal process, or to protect the rights, safety, and security of MultiMFA, our users, or the public.

7. Changes

We may update this policy to reflect product changes, legal requirements, or retention practices. We will post the revised version here and update the effective date. Material changes may be communicated through additional notice where appropriate.

Related: Privacy Policy · Incident Response · Security