Message Masking & GDPR Privacy

Organizations sending One-Time Passwords (OTPs), temporary credentials, banking alerts, medical appointment reminders, or personally identifiable information (PII) often need to prove that an SMS was delivered without retaining the sensitive message content in third-party logs.

Rayo SMS provides built-in Permanent Message Masking to help you comply with GDPR and strict internal data-retention policies.

---

What Permanent Masking Does

When a message is masked in Rayo SMS:

1. Body Replacement: The sms_body of completed messages (those in a final state: sent, delivered, not_delivered, unknown_delivery, or failure) is overwritten in the database with exactly 60 asterisks:

   ************************************************************

2. Irreversible Deletion: The original message text is permanently discarded from the database and cannot be recovered by anyone—including Rayo SMS administrators.
3. Audit Metadata Preserved: All non-content delivery metadata remains intact for billing reconciliation, customer support verification, and compliance auditing:
   • Submission & delivery timestamps
   • Recipient mobile number
   • Sender Identifier (Sender ID)
   • Final delivery status (delivered, not_delivered, etc.)
   • Client reference number (clientRequestId)
   • Credit cost

Masking is Permanent and Irreversible

Once a message body is masked with ************************************************************, the original text is permanently overwritten in storage. It cannot be undone or retrieved.

---

Three Ways to Mask Messages

You can mask messages manually at any time, or configure automated masking rules in the Web Application.

Option 1: On-Demand Manual Masking

Use on-demand masking when you want to manually purge the text of all previously sent messages:

1. Navigate to Sent (/messages) in the left sidebar.
2. Click the red Mask Messages Permanently button.
3. Confirm the prompt in the dialog box.
4. A background job immediately begins masking all eligible completed messages in your account and sends you a confirmation email as soon as the process finishes.

---

Option 2: Immediate Automatic Masking

Use immediate masking if your security policy requires that message text is never retained once an SMS finishes processing (ideal for OTP and 2FA traffic):

1. Navigate to Advanced (top bar) -> Settings -> Mask Messages (/settings/mask_messages).
2. Click Switch On Immediate Masking.
3. From that moment on, every outbound message will have its sms_body permanently masked as soon as processing finishes.

---

Option 3: Delayed Automatic Masking (After X Minutes)

Use delayed masking when your customer support team needs a short window to view recent message content for troubleshooting, after which messages should be redacted automatically:

1. Navigate to Advanced (top bar) -> Settings -> Mask Messages (/settings/mask_messages).
2. Enter the desired retention window in minutes—from 1 minute up to 129,600 minutes (90 days).
3. Click Switch On Masking After This Number Of Minutes (or Update Number Of Minutes if delayed masking is already active).
4. Message bodies remain visible during your configured window and are automatically and permanently masked once the timer expires.