# Compliance starts by not pasting a secret

Study notes. Not vendor documentation and not legal advice.

- Twilio's webhook docs name signing with shared keys, and the security page opened with the title Security.
- The Telnyx guide uses a Bearer API key and tells you to copy it from API Keys. The key is not in this repository.
- Bandwidth does not store message text, on the messaging guide. Your own logs might. Do not put a customer's message in a study note.
- The Twilio article records data breaches in 2022 and 2024. That is a history sentence, not a hardening guide.
- Certificate names, a SOC report, and a HIPAA opinion were not read.

Before a screenshot, search the image for the words Bearer, api_key, and a phone number that belongs to a person. If any appear, crop them. Then write confirm next to any compliance badge you have not opened.