Know where the data goes.

From inquiry to an approved use case

1. Request access

   Submit business contact and project details. Requests are stored privately for review by C9; there is no automatic invitation or supplier access.

2. Verify your account

   Email sign-in establishes access to the invited account. When enabled, SMS verification confirms control of the developer’s test number.

3. Explore your own number

   Before live approval, queries are limited to that verified number. Adding credentials or a payment method does not remove the restriction.

4. Apply for live access

   Business details, the use case, target markets, privacy information, and any required user-flow evidence are reviewed before live network access.

Formatting and network checks

Formatting, numbering-plan validation, and basic line type run in QuietPass using libphonenumber-js metadata. Those checks do not require a carrier lookup supplier. They do not prove that a number is assigned, reachable, or owned by someone.

Current carrier, enhanced line type, and SIM-swap checks may send the queried number, requested check options, and a request reference to the applicable supplier. Coverage, permitted use, and approvals must be satisfied before dispatch. An unavailable result remains unknown. Read the current coverage reference.

Storage and access

The application runs on Cloudflare. Our Supabase database, authentication, and private evidence storage use a main project in Sydney. Browser sessions use encrypted, secure, HttpOnly cookies. Supplier credentials and server API keys are not delivered in page source. Evidence files are served through an authorized backend rather than a public file link.

Early-access requests have no public listing or anonymous database access. Only the configured C9 owner can use the application’s request review page. Operations access is separate from customer access. These measures describe the implementation; they are not a certification or a guarantee that any system is risk-free.

Retention and privacy requests

The privacy notice describes current retention periods and how to request access, correction, or deletion. Live customer processing may need additional retention, transfer, and supplier terms. Establish those requirements with us before sending third-party numbers or relying on a live integration.

Do not put API keys or complete phone-check responses into analytics. When asking for support, start with the request reference and an explanation of the issue; avoid sending customer numbers unless they are needed and an appropriate channel is agreed.

Providers by purpose

Provider support and subprocessors can involve international processing. The privacy notice links the infrastructure providers’ processing terms. Live supplier details will accompany the relevant service agreement.