Built like the target it will be.
An SMS gateway is a money-moving, identity-holding, internet-facing system — attackers know it. Yakugate treats security as engine architecture, not an add-on, and every line of it is open for your auditors to read.
Flexible, modern authentication
Two schemes, per account: signed JWTs or username + password — with policy controls a carrier can actually enforce.
- JWT with HS256, RS256 and ES256 — asymmetric keys verified against per-account PEM public keys
- Configurable subject claims, opt-in token expiry requirements and maximum token lifetimes
- Passwords stored as bcrypt only; a verified-credential cache skips repeat hashing without weakening it — and self-invalidates on password change
- Credentials accepted via header or query, on GET and POST, to meet legacy integrations where they are
Layered brute-force defense
Three independent gates watch every authentication attempt — each with escalating lockout ladders and honest Retry-After headers.
- Identity ladder: repeated failures on one account lock it in escalating steps — 1, 5, 30, then 60 minutes
- Source-IP ladder: high-volume failures from one address are cut off before authentication is even attempted
- Password-spray guard: one IP failing across multiple distinct identities is blocked on the spot — the signature of credential stuffing
- On allowlisted accounts, failures from unknown IPs never penalize the legitimate customer
Anti-enumeration by design
Attackers probing the gateway learn nothing — every ambiguous failure renders identically, while operators get full detail server-side.
- All pre-signature JWT failures return one generic answer — malformed, unknown account or bad key look exactly the same
- Wrong or unregistered submit paths 404 without confirming which of the two it was
- Response formatting is resolved from the URL alone, never from presented credentials — so response shape can't leak valid usernames
- Detailed failure reasons go to server logs only, where your team can see them and attackers can't
Network-level controls
Know exactly who is talking to you — even behind load balancers — and restrict every account to where it should connect from.
- Per-account source-IP allowlists enforced in the pipeline before any message is accepted
- Trusted-proxy support: X-Forwarded-For honored only from explicitly listed peers, resolved rightmost-untrusted — spoofing gets you nowhere
- One consistent client-IP resolution shared by lockouts, spray guard, allowlists and audit logging
- SMPP binds authenticate through the same ladders and spray guard as HTTP
Data protection & auditability
What gets persisted is allow-listed; what gets charged is append-only; what gets changed is audited.
- Rejected requests are logged with allow-listed headers only — credentials and raw query strings are never written to disk
- Balance movements live in an append-only ledger with idempotency guards — no silent mutations, ever
- Rate cards are versioned, never edited — every historical charge resolves to the exact rate that priced it
- Abuse-monitor actions (warn, throttle, suspend) leave a full audit trail
Encryption in transit & certificates
Standard cryptography, standard certificates — no proprietary formats, no surprises for your PKI team.
- TLS 1.2 / 1.3 in front of both the HTTP and SMPP edges — terminate at your load balancer, proxy or the process itself
- Any standard X.509 certificate works: Let's Encrypt, enterprise CAs, or your internal CA — plain PEM, nothing exotic
- RSA (2048+) and ECDSA (P-256) key material supported end to end — the same formats your existing infrastructure already issues
- DLR webhooks push to HTTPS endpoints, so receipts stay encrypted on the way back to your clients
Key management, KMS-friendly
Signing and verification keys are standard PEM — provision them from whatever KMS your organization already trusts.
- Compatible with AWS KMS, Azure Key Vault, Google Cloud KMS and HashiCorp Vault as the source of key material and secrets
- Per-account JWT public keys: each customer verifies against their own PEM — one compromised key never exposes another tenant
- Asymmetric-first: RS256/ES256 mean the gateway holds only public keys — the private key never leaves your customer's KMS
- Secrets live in environment/config, never in code — rotate by re-issuing from your KMS and refreshing config, no rebuild
Content & traffic protection
The same pipeline that routes your traffic protects it — screening content and watching behavior on every single message.
- Blocklists and whitelists at global and account level, normalized so formatting tricks don't slip through
- Spam keyword gates with per-account strict variant matching for high-risk senders
- Template enforcement: restrict an account to pre-approved message templates
- Sliding-window abuse scoring across AIT, spend, spam and template dimensions with automatic graduated response
Reviewed by someone who defends a bank for a living.
Yakugate's security architecture is thoroughly reviewed by Imran Rasheed — a UK-based Chief Information Security Officer at one of the world's largest banking groups, with a career spent securing systems that attackers target hardest. He liked the engine enough to become our UK distribution partner.
His review goes beyond a checkbox pass: the gateway is assessed against the emerging threat landscape — AIT and artificially inflated traffic, credential stuffing, smishing-driven abuse — and for compatibility with the frameworks security teams actually certify against.
- Emerging threats — AIT, flooding, credential attacks, sender-ID abuse
- Framework compatibility — ISO 27001, SOC 2, NIST CSF, GDPR alignment
- Cryptography & key handling — TLS, JWT algorithms, KMS-sourced keys
- Banking-grade controls — auditability, least privilege, data protection
Speaks your auditor's language.
Everything cryptographic is standards-based, and everything operational leaves the evidence trail your SOC 2 or ISO 27001 certification needs. Certifications belong to deployments — Yakugate gives yours the architecture to earn them.
Trust, but verify. The code is right there.
Closed gateways ask you to trust their security claims. Yakugate is MIT-licensed — run your own review, your own scanners, your own pen test.