Security
A plain overview of how PhoneBelo protects the control plane. We do not overclaim features that are still evolving.
Transport
The public site and API are served over HTTPS on phonebelo.com with modern TLS. Prefer the domain over plain IP access.
Authentication
Accounts use email and password with server-side session cookies. State-changing API calls require CSRF tokens. Password reset and email verification flows are available in the product.
Isolation & quotas
Devices, proxies, and usage are scoped to the owning account. Platform quotas limit how many instances and viewer sessions you can run. Platform admins can review users, instances, and audit events.
Secrets
Proxy credentials are stored encrypted at rest and are write-only in the API — they are not returned in list responses.
Report an issue
Email security@phonebelo.com. Please include steps to reproduce and avoid sending production passwords.