Use cases · Inalambria Verify
Confirm that your users’ phone numbers and email addresses really belong to them without ever exposing the code. Verify delivers it over WhatsApp, SMS or Email with an automatic cascade, includes anti-fraud and only charges for approved verifications.
Verifying a phone number or email is the most fragile step in any sign-up: if the code does not arrive, the user leaves, and building the logic in-house means maintaining secure codes, expiry, attempt limits, retries, WhatsApp templates and fraud defenses.
With Inalambria Verify your application makes two HTTP calls, one to send the code and one to check it, and we take care of everything else: the code never touches your systems, is never stored in clear text and never shows up in a log. It all runs on the same redundant network, connected directly to all four Colombian carriers, that we already use to deliver OTPs for Colombia’s most demanding banks and fintechs.
What we commit to
It never passes through your systems, it is stored as an irreversible hash and it never shows up in a log. There is nothing to leak.
Every verification ends, approved, expired or failed, and your backend finds out through a signed webhook, without having to ask.
Expired, failed, blocked for fraud or out of attempts: zero. You pay for verified users, not for messages.
How it works
Your application only sends and checks. Verify takes care of generating the code, the channel cascade, the attempts and closing the verification.
Behind the six boxes
What your user sees as a six-digit field hides all of this. Verify solves it for you.
Cryptographic randomness (CSPRNG), 4 to 10 digits.
With an Idempotency-Key, if your system retries after a network glitch, only one message goes out.
Limits per number, IP and application, plus blocking by country or prefix, stop inflated traffic.
Approved authentication templates for WhatsApp, SMS and Email, ready from the first send.
With no answer after 120 s, the same code goes out over the next channel.
Every code expires in minutes (5 by default) and the verification closes itself.
After 3 failed attempts it locks: nobody can guess at random.
Your backend receives a signed webhook with every result.
It is stored as an irreversible hash: nobody can read it, not even us.
Security and compliance
24/7 response · alerts and escalation
Detection · SIEM/SOC and continuous monitoring
Edge · WAF, DDoS, bot management and limits
Network · private subnets and IPSec VPN
Identity · MFA, SSO and least privilege
Data · AES-256 encryption, versioning and retention
Optional · Risk signals
An OTP confirms that someone receives the code, not whether the line was hijacked. With Inalambria you can also add two optional checks that spot risk signals before you send the code or approve a sensitive operation.
Was this number’s SIM changed recently?
Checks whether the SIM tied to the number was changed recently. It is the classic sign of SIM hijacking: someone duplicates your user’s SIM to receive their codes. If the change is recent, you can ask for an extra factor, hold the operation or review it before sending the OTP.
Did this number switch carriers in Colombia?
Checks whether the number was ported and which carrier it belongs to today. A recent port, right before a sign-up or a change of details, is a risk signal worth weighing, and knowing the current carrier confirms the number is valid and active in Colombia.
Both checks are optional and combine with Verify in the same flow: you decide which signal calls for an extra step, such as a second factor or a manual review. They are ideal for sign-ups, account recovery, changes of details and high-value transactions.
Integration, availability and support
Stateless services with autoscaling: if a non-critical component goes down, such as analytics, webhooks or a channel, verifications keep going.
REST API behind Cloudflare: WAF, DDoS protection, rate limiting, IP and country blocking, and TLS.
100% private traffic between AWS accounts: no public IP, no internet, no VPN.
IPSec IKEv2 tunnel with AES-256 encryption from your core systems or your datacenter.
Multi-AZ with cross-region replication and failover, backups and tested disaster recovery.
Operations watched day and night, tracking SLA compliance.
Portal, email and WhatsApp, handling through resolution, and a relationship manager with monthly reviews.
A portal with reports, users and roles, a status API and webhooks with 32+ states.
No. The code is generated with cryptographic randomness, stored only as a salted Argon2id hash and deleted when the verification closes. No response, log or webhook includes it.
If nobody checks the code within 120 seconds, the cascade sends the same code by SMS and then by Email. Any of the messages received works, and your application does not have to do anything.
Nothing. Only approved verifications are billed: expired, failed, fraud-blocked or out-of-attempts verifications cost nothing, however many messages went out.
Yes. Besides Verify, Inalambria offers optional SIM Swap checks, which tell you whether the number’s SIM changed recently, and number portability checks in Colombia, which tell you whether the number switched carriers and which one it belongs to today. You can run them before sending the code or approving a sensitive operation, and ask for an extra step when there is risk.
Besides the public API protected by Cloudflare, you can connect over AWS PrivateLink, with no public IP or internet, or through a site-to-site IPSec VPN from your datacenter.
Yes. The test environment with test_ keys sends no messages and is never billed, and the full documentation is at docs.inalambria.com. After that, a pilot with measurable goals takes your flow to production.
Start today with test keys and documentation, then go live with a measurable pilot.