# Twilio Security Review
# Classification: Confidential
# Date: 2026-06-09
# Reviewer: Claude Code (drafted); pending Founder approval
# Status: Draft

---

## 1. Vendor / Device Overview

| Field | Value |
|---|---|
| **Name** | Twilio Inc. |
| **Website** | twilio.com · trust center: security.twilio.com |
| **Service / purpose** | Cloud communications platform — programmable voice (IVR), telephony, Messaging Service (SMS, provisioned not yet wired) |
| **CBB use case** | ScopeDOPE customer-intake IVR (1-877-DOPE-707) and CBB Corporate line (1-855-COLD-390): two-level Studio voicemail flows with email delivery; future SMS via Messaging Service (DOPE-34/35) |
| **Data tier(s) accessed** | Tier 2 (General) — inbound caller phone numbers, voicemail audio, transcriptions. No Tier 3/4 material. |
| **Access type** | API key + auth token (REST API); Studio flow; no interactive end-user auth |
| **Proposed onboarding date** | Already in production — retrospective review |

---

## 2. Data Exposure Assessment

### 2.1 What CBB data will this vendor / device access?

- Inbound caller phone numbers (caller ID) reaching the IVR
- Voicemail audio recordings (≤120 s per CBB IVR standard) and any transcription
- Call metadata (timestamps, duration, called number, menu option selected)
- The phone numbers themselves as brand assets (1-877-DOPE-707, 1-855-COLD-390)

No customer accounts (ScopeDOPE has none — §4.6), no ballistic/DOPE data, no SPEC material, no payment data.

### 2.2 Where will CBB data be stored by this vendor?

On Twilio's infrastructure (AWS/GCP regions). Voicemail recordings are delivered out to the `noreply@` mailbox via SendGrid and can be deleted from Twilio after dispatch. Customer Data is encrypted in transit (TLS 1.2) and at rest (AES) per Twilio's security overview.

### 2.3 Is any Highly Confidential data (Tier 4) involved?

- [ ] Yes
- [x] **No** — IVR handles general inbound contact only. No SPEC, engine internals, or DOPE-Blend methodology touches Twilio.

---

## 3. Vendor Security Posture (Software vendors only)

### 3.1 Compliance and certifications

| Standard | Certified? | Notes |
|---|---|---|
| SOC 2 Type II | Yes | Published via Twilio Trust Center (SafeBase, security.twilio.com); SOC 2 Type II covers core Programmable Voice/Messaging |
| ISO 27001 | Yes | ISO/IEC 27001 certified; also attests ISO 27017 (cloud) and ISO 27018 (PII) |
| GDPR compliant | Yes | Twilio GDPR program; DPA available; ISMS-based safeguards |
| CCPA compliant | Yes | CCPA/CPRA addressed in Twilio privacy terms |

> Reviewer to confirm the current SOC 2 Type II report date and scope against security.twilio.com at approval time.

### 3.2 Data processing agreement

- [x] A Data Processing Agreement (DPA) is available via Twilio's legal terms
- [ ] A DPA is not available

> **Condition:** Confirm Twilio DPA is executed/accepted for the CBB account.

### 3.3 Breach history

Twilio disclosed a 2022 social-engineering/phishing incident affecting some customer data (the "0ktapus" campaign) and a 2024 Authy phone-number enumeration issue. Neither is known to have exposed CBB data (CBB onboarded after, with MFA + scoped API keys). Reviewer to re-check current public disclosures at approval.

### 3.4 Security documentation

- [x] Vendor publishes a security/trust page (security.twilio.com, twilio.com/trust-center)
- [x] Vendor publishes a current SOC 2 report (available under NDA via Trust Center)
- [x] Vendor has a responsible disclosure / bug bounty program

### 3.5 Authentication and access control

- [x] Vendor supports MFA (Twilio Console login)
- [x] Vendor supports SSO / SAML (paid Organization tier)
- [x] Vendor supports API key scoping (standard/main/restricted keys)
- [x] Vendor supports OAuth-style scoped access for API

---

## 4. Hardware Security Assessment (Hardware / BLE devices only)

**N/A** — software/SaaS vendor.

---

## 5. Integration Security

### 5.1 Credential management

All Twilio credentials are in Azure Key Vault — no secrets in code, config, or docs:

- [x] CBB Corporate auth token → `kv-cbb-shared-prod` → `twilio-cbb-auth-token`
- [x] ScopeDOPE auth token → `kv-scope-dope-prod` → `twilio-scopedope-auth-token`
- [x] CBB Corporate API key → `kv-cbb-shared-prod` → `twilio-cbb-claude-code-cli-secret`
- [x] Credentials scoped to minimum required permissions
- [x] Credentials unique to this integration

**Product-line isolation:** Organization → CBB Corporate (parent) → ScopeDOPE (subaccount, `AC7cc6…`). ScopeDOPE telephony assets are credential-isolated from CBB Corporate, supporting a clean product-line carve-out.

### 5.2 Network exposure

Twilio reaches CBB only via outbound webhook to the Studio/Function flow and SendGrid email dispatch. No inbound firewall rule or public IP on CBB infrastructure is opened for Twilio. Webhook signature validation should be enforced on any custom webhook endpoint.

### 5.3 Offboarding plan

Revoke: rotate/delete the auth tokens and API keys in Key Vault, release or port the phone numbers, deactivate the Studio flows. For a ScopeDOPE-only sale, transfer the ScopeDOPE subaccount and its numbers to the buyer's parent account; CBB Corporate retains its line.

---

## 6. Risk Summary

| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Caller PII (phone #, voicemail) exposed via vendor breach | L | M | Tier-2 data only; SOC 2/ISO vendor; voicemail purges after dispatch; ≤120 s cap |
| Auth token leakage | L | M | Tokens in Key Vault, scoped, never in code; rotation documented in runbook |
| Toll fraud / unexpected spend | L | M | Geo-permissions, spend monitoring; subaccount isolation bounds blast radius |
| Webhook spoofing | L | L | Enforce Twilio signature validation on custom endpoints |

**Overall risk rating:** **Low**

**Recommendation:** **Approve with conditions** — pending Founder sign-off.

**Conditions:**
1. Confirm current SOC 2 Type II report date/scope at approval (security.twilio.com).
2. Confirm Twilio DPA executed for the CBB account.
3. Confirm Twilio signature validation is enforced on any custom webhook endpoint.
4. Add Twilio to the "CBB Risk Register" SharePoint List.

---

## Document Control

| Field | Value |
|---|---|
| **Document owner** | `jschwefel@coldboreballisticsllc.com` |
| **Classification** | Confidential (`03_-_Confidential/`) |
| **Location** | `OneDrive/CBB_Corporate/03_-_Confidential/Infrastructure/Twilio/Twilio_Security_Review.md` |
| **Cross-references** | `Twilio_Architecture_Reference.md`; `Twilio_Acquisition_Brief.md`; `Azure_Key_Vault_Architecture_Reference.md`; "CBB Risk Register" SharePoint List |
| **Created** | 2026-06-09 |
| **Last updated** | 2026-06-09 |
| **Next full review due** | 2027-06-09 |

---

## Revision Control Block

| Rev | Date | Changed By | Reviewed By | Approved By | Summary |
|-----|------|------------|-------------|-------------|---------|
| DRAFT | 2026-06-09 | Claude Code | — | — | Initial draft. Vendor posture verified against Twilio Trust Center (SOC 2 Type II, ISO 27001/27017/27018, GDPR/CCPA). Recommends Approve with conditions pending Founder sign-off. Version number to be assigned by Founder on approval. |
