---
title: "Security — encryption, access checks and activity records"
description: "How Shared MFA Inbox protects authenticator keys, checks team access, records actions and erases SMS text. Read the safeguards and their limits."
canonical: "https://sharedmfainbox.com/security"
---

# The safeguards behind every code.

> How Shared MFA Inbox protects authenticator keys, checks team access, records actions and erases SMS text. Read the safeguards and their limits.

Encrypted authenticator keys. Access tied to your team. A record of key actions. Here’s how it works, and where the limits are.

[Ask a security question](mailto:support@sharedsmsinbox.com)

## Setup keys stay protected.

Authenticator setup keys are encrypted with AES-GCM. The server reads a key to generate a code; the saved key is never sent back to your team.

**Encrypted setup key** — Stored on the server

Your own login → Account access checked → Fresh code returned

The service can decrypt the key to generate codes. This is not zero-access encryption.

## Access is checked on each request.

### Authenticator accounts

Share each account with specific people or groups. Its creator and team admins keep management access; you can give others access to use or manage it.

### SMS numbers

Members see only numbers they have permission to read. Owners and admins can see all numbers in their team.

### When someone leaves

Remove them from the team to block their next request. Review saved passwords, active sessions and recovery options at the original service too.

## A record of who did what.

The activity log records actions here. It cannot prove what happened after sign-in at another service, and cannot be edited or cleared in the app.

| Recorded | Kept out of the log |
| --- | --- |
| Who generated or copied a code | The code itself |
| Who opened a message | The message text |
| Who changed access | The saved setup key |

## Less text left behind.

SMS text and codes are erased after 72 hours by default. Admins can change the retention period.

- Text & codes erased
- Sender, number & arrival time remain

Erased text cannot be recovered. SMS text is not encrypted at rest, and shared access does not make SMS itself more secure.

## Look a little closer.

- [Privacy and data handling](https://sharedmfainbox.com/privacy) — What we store, why we store it and who processes it.
- [Offboarding a teammate](https://sharedmfainbox.com/blog/shared-mfa-offboarding-checklist) — A practical guide to accounts, recovery and saved sessions.
- [Talk to us about security](mailto:support@sharedsmsinbox.com) — Ask about a safeguard or report a concern.

---

Canonical: https://sharedmfainbox.com/security

Every page of this site is also available as Markdown. Site map: https://sharedmfainbox.com/llms.txt