SMS alert security at Welco

SMS alert security at Welco starts here: Welco only receives the alert emails your systems send out, so nothing connects into your network. Only senders you approve can trigger a text, and only staff who replied YES receive one. File links are private and expire after 7 days, or up to 30. A STOP reply ends all texts.

Approve my first sender Book a demo

7-day free trial, 15 message creditsCard required for verificationNo charge for 7 daysEmail reminder before billing

No inbound access to your network
Approved senders only
Alerts-only numbers

Published: October 6, 2026

Approved senders only

Try it: turn it off and on.

Without it: anyone who learns the address can text your team

With it: only the systems you approve can start a text

On. The phone gets 1 text.

What your security review will find

Your network stays closed
Welco needs no agent, no open port and no remote login. Your system sends an email out through your normal mail server, and that is all Welco sees.
Only your systems can start a text
Mail from an address you haven't approved is refused, so a stranger can't text your team.
Only confirmed staff receive alerts
Each person joins with their own phone and replies YES. An unconfirmed phone gets nothing.
Files are private and short-lived
Voicemail and PDF links stay out of search engines and stop working when they expire.

The security checklist, answered

These are the questions an IT or security reviewer usually asks. Each answer links to the page with the detail.

Does Welco connect into our network?

Answer: No. It only receives the alert email your system sends. Firewall rules stay as they are.

Who can trigger a text?

Answer: Only the sending addresses you add to your approved senders.

Who can receive a text?

Answer: Only staff who opened their own join page and replied YES. See how opt-in works.

Can Welco write back into our system?

Answer: No. Text replies come back by email only, and nothing in your system is changed.

Are the sending numbers shared with marketers?

Answer: No. Welco numbers carry alerts only. A dedicated alert number is an option.

How long is our data kept?

Answer: While you subscribe, plus 3 months after you cancel. The table further down lists each kind of record.

What happens on STOP?

Answer: Welco stops texting that number, and no rule or sender can override it.


Does Welco connect into our network?	No. It only receives the alert email your system sends. Firewall rules stay as they are.
Who can trigger a text?	Only the sending addresses you add to your approved senders.
Who can receive a text?	Only staff who opened their own join page and replied YES. See how opt-in works.
Can Welco write back into our system?	No. Text replies come back by email only, and nothing in your system is changed.
Are the sending numbers shared with marketers?	No. Welco numbers carry alerts only. A dedicated alert number is an option.
How long is our data kept?	While you subscribe, plus 3 months after you cancel. The table further down lists each kind of record.
What happens on STOP?	Welco stops texting that number, and no rule or sender can override it.

Only approved senders can trigger a text

Your Welco address only accepts mail from senders you approve. Anything else is refused and never becomes a text.

You add each system's sending address, such as your SCADA server or monitoring tool, to your approved list. If someone guesses your Welco address, they still can't text your team. You can also set daily and monthly limits for each sender.

Every business is checked, every phone says YES

Three checks stand between an alert email and a phone.

We verify the business
No account can send a single text until we have checked the business behind it. That covers a work email on its own domain, its business details, a card and a short intro call.
Each phone confirms with YES
Each person opens their join page, enters their own number and ticks an unchecked box. Then they reply YES to one confirmation text. The exact wording is on our SMS compliance page.
Blocked words are held
Before sending, Welco checks each text for blocked words and phrases, such as links from public shorteners or card numbers. A match is held, not sent.

Voicemail and file links are private and expire

When an alert carries a voicemail, photo or PDF, Welco does not text the file itself. It keeps the file in private storage and puts a short link in the text.

The file can only be reached through its link page, served over HTTPS.
Link pages are kept out of search engines and are not cached.
Each person who gets the alert gets their own link.
Links last 7 days by default. You can set a source to keep links for up to 30 days. After that, the link stops working.

What this means for your team

No login is needed to open a link, so anyone holding the text can open it until it expires. Treat alert texts like any other work message. See how voicemail and file links work.

What data Welco keeps, and for how long

These periods match our privacy policy. Email hello@welco.ai to ask for a copy of your data, or to have it deleted sooner.

Account data and alert history

How long we keep it: While you subscribe, plus 3 months after you cancel

Consent and opt-out records

How long we keep it: 4 years, to prove each person agreed

Invoices and payment records

How long we keep it: 7 years, for tax rules

Voicemail, photo and PDF links

How long we keep it: 7 days by default, up to 30 if you set it

Deleted data in backups

How long we keep it: Removed within 30 days


Account data and alert history	While you subscribe, plus 3 months after you cancel
Consent and opt-out records	4 years, to prove each person agreed
Invoices and payment records	7 years, for tax rules
Voicemail, photo and PDF links	7 days by default, up to 30 if you set it
Deleted data in backups	Removed within 30 days

How Welco handles STOP and opt-outs

Anyone who gets Welco texts can reply STOP at any time. Welco then stops texting that number, and no rule or sender can override it.

That protects the person, but it can surprise a team. If an on-call phone replied STOP, it will miss alarms until the person opts back in. Delivery reports show which numbers have opted out, so you can spot it.

Replying HELP gets help. People can also write to hello@welco.ai.

Frequently asked questions

Can someone text my team by guessing my Welco address?

No. Welco only turns mail from approved senders into texts. Mail from any other address is refused. Keep your list of approved senders short and remove systems you no longer use.

Do we need to open a port or change the firewall for Welco?

No. Your system sends its alert email out through your normal mail server, as it may already do. Welco never logs in to your network or your systems. Nothing reaches back in.

How long can someone open a voicemail link from an alert?

For 7 days by default. You can set a source to keep its links for up to 30 days. When the time is up, the link stops working and the file can no longer be opened from it.

Does Welco share staff phone numbers with anyone?

Phone numbers collected for texting are not shared with any third party or affiliate for marketing. Our privacy policy has the full wording and lists what we collect.

Does Welco hold any security certifications?

Welco makes no certification claims, so plan your review around the controls on this page instead of an audit report. If your review needs a questionnaire filled in, email hello@welco.ai with Security in the subject.

What should we keep out of alert texts?

Passwords, full card numbers, bank details and government ID numbers. Welco holds any text that contains them, so it never reaches a phone. Keep names of customers or patients out too, and let the text point to the system where the detail lives.

How do I report a security concern?

Email hello@welco.ai with Security in the subject. Tell us if you think someone is misusing Welco, or if you found a problem with how we protect data. Our acceptable use policy lists what counts as misuse.

Approve your first sender and send a test alert