​
Overview

The Twilio integration syncs your communications-platform configuration into LowerPlane: account settings, phone numbers, TwiML applications, SIP domains, and API keys. LowerPlane authenticates with a Twilio API key to collect compliance evidence automatically and run continuous checks on how that traffic is protected in transit and how your API credentials are managed. LowerPlane deliberately does not collect message or call traffic, recordings, queues, emergency addresses, or billing usage. None of it evidences a control, and aggregate volume counts are not something an auditor accepts — so it is not worth the data-handling exposure on a platform holding customer PII.

​
Prerequisites

  • You need your Account SID plus an API Key SID and Secret created in the Twilio Console.
  • Do not use your account Auth Token. Twilio’s guidance is that third-party integrations authenticate with an API key: a key can be revoked on its own, while revoking the Auth Token breaks every other integration on the account.
  • The API Key Secret is displayed only once, immediately after you create the key.

​
How to Get Your Credentials

1

Sign in to the Twilio Console

Log in at console.twilio.com.
2

Copy the Account SID

On the Console dashboard, find the Account Info panel and copy the Account SID. It always begins with AC. This identifies which account LowerPlane reads from.
3

Create an API key

Go to Account → API keys & tokens, then click Create API key. Name it something identifiable such as LowerPlane.Pick the key type using the table below — it determines which checks can run.
4

Copy the Key SID and Secret

Copy the SID (begins with SK) and the Secret. The secret is shown only once; if you lose it, create a new key rather than falling back to your Auth Token.

​
Which key type to choose

Twilio permits only Main API keys to read the Account and Keys resources. A Standard or Restricted key returns 401 on those two endpoints while every other endpoint works normally.
Key typeWebhook + SIP checksAPI key rotation checkAccount evidence
Main✅✅✅
Standard✅⚠️ no data — reports not applicable⚠️ skipped
Restricted✅ with read access granted⚠️ not grantable⚠️ skipped
Choose Main if you want all four checks. Twilio does not allow key-listing permission to be granted to Standard or Restricted keys, so the rotation check cannot work with them — LowerPlane logs this explicitly rather than letting the check sit silently empty.
If you create a Restricted key, grant it read access to Incoming Phone Numbers, Applications, and SIP Domains. A missing permission surfaces as a 403 on that collector; LowerPlane skips it and continues, so a narrow key still yields partial coverage.
Using a subaccount? Connect it with that subaccount’s own Account SID and an API key created under that subaccount. LowerPlane collects only the resources belonging to the account you connect.

​
Connecting in LowerPlane

1

Navigate to Integrations

Go to Integrations from the main navigation and search for Twilio.
2

Enter your credentials

Paste the Account SID, API Key SID, and API Key Secret.
3

Connect

Click Connect. LowerPlane saves the credentials and queues the first sync; if anything is wrong, the sync reports it — check the integration’s sync status rather than assuming a successful connect means valid credentials.
To disconnect completely, delete the key in the Twilio Console — that revokes LowerPlane’s access immediately and without affecting any other integration. This is why LowerPlane asks for an API key rather than your Auth Token: revocation is scoped to us alone.

​
What LowerPlane Monitors

Phone Numbers

Every number, its capabilities, and whether its voice and messaging webhooks use HTTPS.

TwiML Applications

Application callbacks — request, fallback, and status callback URLs — and their transport security.

SIP Domains

Elastic SIP Trunking domains and whether secure media (TLS + SRTP) is required.

API Keys

Key inventory with creation dates, so stale credentials surface for rotation.
Alongside the four checks, LowerPlane collects account-configuration evidence. That is the complete set — five read-only endpoints, nothing else.

​
Automated Checks

CheckWhat it verifiesControls
Phone number webhooks should use HTTPSEvery configured voice and messaging webhook on a number uses https://SOC 2 CC6.7 · ISO 27001 A.8.24
Application webhooks should use HTTPSEvery callback on a TwiML application — including the status callback — uses https://SOC 2 CC6.7 · ISO 27001 A.8.24
SIP domains should require TLSSecure media is enabled, requiring SIP over TLS and SRTPSOC 2 CC6.6, CC6.7 · ISO 27001 A.8.20, A.8.24
API keys should be rotated at least yearlyNo API key is older than 365 daysSOC 2 CC6.1 · ISO 27001 A.5.17
A phone number or application with no webhook configured passes the transport checks. An unused number is not a transport-security finding, and failing it would bury the real ones.

​
Data Handling

  • Phone numbers are hashed before storage. LowerPlane keeps a one-way hash for correlation, never the number itself.
  • Message and call data is never touched. LowerPlane does not read the Messages, Calls, or Recordings endpoints at all — not content, and not aggregate counts.
  • API key secrets are never collected. Twilio does not expose a key’s secret after creation; LowerPlane stores only the key SID, friendly name, and creation date.
  • Emergency addresses and billing usage are not collected. Those endpoints are never called.
Twilio’s REST API does not expose Console users, so Twilio is not an access-review source in LowerPlane and will not appear in user access reviews. Manage Console access through your identity provider instead.

​
Troubleshooting

LowerPlane received a 401 from Twilio. Check that the API Key SID begins with SK (not AC — that would be the Account SID) and that the secret was copied in full. If the key was deleted in the Console, create a new one.
A 404 usually means the Account SID is wrong, or the API key belongs to a different account or subaccount than the Account SID you entered. Both must come from the same account.
LowerPlane could not list your API keys, which Twilio permits only for Main API keys. Create a Main key and reconnect. The sync log states this directly: “Cannot list Twilio API keys: this requires a Main API Key.”
Same cause: reading the Account resource requires a Main API key. Every other collector is unaffected, and the sync is not marked failed.
The API key is Restricted and lacks read permission for that resource. Grant it in the Console, or use a Standard or Main key.
The checks evaluate real resources, so an account with no phone numbers, TwiML applications, or SIP domains has nothing to test. This is accurate rather than a failure — the checks begin reporting once those resources exist.
SIP domains exist only on accounts using Elastic SIP Trunking. If you do not use it, this collector returns nothing and the SIP check has no entities to evaluate — that is expected, not a failure.
The check reads Twilio’s date_created, which reflects when the key was created, not when it was last used. Rotating means issuing a replacement key and deleting the old one; editing a key’s friendly name does not reset its age.
LowerPlane follows Twilio’s pagination and caps each collector at 50 pages. If that cap is reached it is recorded in the sync log rather than truncating silently — contact support if you see it.