ZeroSettle reliability and trust: uptime, spam flags and security
ZeroSettle publishes a short reliability and trust record for its iMessage API: a “99.9% uptime” stat on its homepage (not an SLA), sends that normally return in 2–5 seconds, and inbound texts at your webhook about 1–2 seconds after they reach the line. ZeroSettle says it has seen a number flagged as spam “only twice” across more than 10,000 messages a week and replaces a flagged number at no extra charge; it enforces STOP across every number on your account and signs every webhook with HMAC-SHA256. ZeroSettle does not promise delivery of every message, read receipts in its API, or end-to-end encryption. This hub sums up each topic and links the page that covers it in depth.
Key takeaways
- Uptime: ZeroSettle reports “99.9% uptime” on its homepage. It is a stat, not an SLA, and the terms disclaim uninterrupted operation.
- Speed: a send normally returns in 2–5 seconds (at most about 75 for a text, about 105 for a photo or voice message), and an inbound text reaches your webhook about 1–2 seconds after the line receives it.
- Spam flags: rare. Across more than 10,000 messages a week, ZeroSettle says it has “seen it happen only twice”. A flagged number is replaced at no extra charge, and your token, webhook and code stay the same.
- STOP: a text with the word STOP, or a clear request like “take me off your list”, opts the contact out across every number on your account, and only START opts them back in.
- Security: bearer tokens for API calls, and every webhook signed with HMAC-SHA256 with a 300-second tolerance. ZeroSettle makes no end-to-end encryption claim.
- Price: Pro is $49/month; Growth is from $599/mo. Both have a 30-day money-back guarantee on the subscription.
What does ZeroSettle publish about reliability, and what doesn't it promise?
ZeroSettle publishes six reliability figures, on its homepage and in its API docs, and none of them is a contractual commitment.
| Figure | ZeroSettle's wording | Where | What it is |
|---|---|---|---|
| Uptime | “99.9% uptime” | Homepage stats | Stat, no SLA |
| Volume | “10,000+ messages/week” | Homepage stats | Stat |
| Send call | “normally 2–5 seconds and at most about 75 for a text (about 105 for a voice message or photo, which ZeroSettle converts first)” | Docs, “Send a message” | Documented behavior |
| Inbound | “about 1–2 s from the line receiving a text to your webhook” | Docs, “Errors, limits, and compliance” | Documented behavior |
| Webhook retries | “3 more times, after 1 s, 5 s, and 20 s” | Docs, “Webhooks, step by step” | Documented behavior |
| Spam flags | “across more than 10,000 messages a week we have seen it happen only twice” | Homepage FAQ | Company statement |
None of these figures states a measurement period or method, and ZeroSettle publishes no independent audit of them.
ZeroSettle's iMessage API Terms and docs also say what is not promised:
- No SLA or uptime warranty. “ZeroSettle does not warrant that the services will meet your requirements or that their operation will be uninterrupted or error-free.”
- No delivery promise. The Services depend on Apple’s iMessage service, “and delivery of any particular message or feature is not guaranteed.”
- No read or delivered receipts in the API. The API reports
message.sent(the message left the line) andmessage.failed, and no later event. - No end-to-end encryption. Content “may not be encrypted and … ZeroSettle cannot guarantee communication privacy.”
- No Apple affiliation. “ZeroSettle is not affiliated with, endorsed by, or sponsored by Apple Inc.”
For contrast, as of October 2026, per its public site, Twilio's APIs Service Level Agreement commits to 99.95% monthly availability for its Services APIs, measures API availability rather than message delivery, and pays service credits, not refunds. The iMessage API comparisons cover other providers.
How does ZeroSettle report failures, and what happens to a flagged number?
ZeroSettle reports each failure to your code as an error code or a webhook event, and replaces a flagged number at no extra charge; four pages explain those signals.
| Situation | What your code sees | What to do |
|---|---|---|
| The line is temporarily unreachable or doesn't answer in time | 503 | Retry with backoff |
| Another send on the line is in progress | 429 line_busy after about 12 s | Retry after 2 s |
| The number has reached its new-contact limit | 429 new_contact_limit with retry_after_s | Wait retry_after_s; ongoing conversations are not limited |
| Your webhook returns non-2xx or takes over 10 s | Retries after 1 s, 5 s and 20 s, then ZeroSettle records the failure (last_delivery shows the newest delivery) | Answer 2xx within 10 s; dedupe on message.id plus event |
| A send is recorded but not delivered | message.failed | Treat it as not delivered |
| Apple flags the number | Every send fails, to everyone | Nothing in your code: ZeroSettle replaces the number |
- How reliable is ZeroSettle? Uptime, delivery, spam and failures
- Every published figure with its source and status, each failure mode in detail, what isn't promised, how the figures are measured, and how the evidence compares with other providers'.
- What does 99.9% uptime mean for an iMessage API?
- 99.9% allows about 43 minutes of downtime in a 30-day month. Why ZeroSettle's figure is a stat, not an SLA, and what Twilio, Linq and others publish instead.
- iMessage delivery status, webhook retries and latency explained
message.sentmeans the message left the line andmessage.failedmeans it was not delivered; there is no read event. Plus which errors mean retry and which mean stop.- What happens if your iMessage number is flagged as spam?
- Every send fails until ZeroSettle replaces the number, at no extra charge. Your token, webhook and code stay the same, but recipients see texts from a new number.
It is rare. The API's rate limits are designed to keep every line out of spam filters, and across more than 10,000 messages a week we have seen it happen only twice. If it does happen, we replace the number right away at no extra charge. Your API token, webhook, and code stay exactly as they are, so your integration keeps running without changes.
zerosettle.io FAQ, “What if a number does get marked as spam?”
How does ZeroSettle handle spam limits, STOP and security?
ZeroSettle enforces new-contact limits and STOP on every account and signs every webhook; getting consent and checking the signature stay your job.
- STOP: “When a contact texts STOP, the server records it and blocks your number (every number on your account) from reaching them.” Any text with the word STOP in it counts, and so does a clear request like “take me off your list”; only START opts them back in. Texts, voice messages, photos, reactions, typing and name-and-photo shares to them return
403 recipient_opted_out; nothing is sent or stored. - Signing:
X-ZeroSettle-Signature: t=<unix>,v1=<hex>is an HMAC-SHA256, keyed with your webhook secret, of"<t>."plus the raw body, with a 300-second tolerance. Verify the raw bytes before parsing and compare in constant time. The secret is shown once and rotates when you register again; the docs' webhook steps have Python and Node verifiers. - Recipients' spam folders: separately from a flag on your number, iOS 26 on a recipient’s iPhone filters messages its spam detection judges to be junk into a Spam folder, on by default and with no notification (Apple Support).
message.sentcan't tell you whether a text landed there.
- How to keep a business iMessage number out of spam filters
- What gets a number flagged, the new-contact limits per number (Pro: 5 a day; Growth: 50 a day, 3 per 15 minutes) and why people who text first are never limited.
- How STOP and opt-outs work on a ZeroSettle iMessage line
- What counts as an opt-out, how START reverses it, and how
GET /api/imessage/opt-outslists every opt-out with its time. - Is ZeroSettle's iMessage API secure? Tokens, webhooks, data
- Tokens, signature checks, data retention, and what ZeroSettle does not claim: end-to-end encryption, SOC 2 certification or HIPAA compliance.
- iMessage marketing and TCPA consent: a practical guide
- Consent records, quiet hours and STOP. Under the TCPA, as generally read, a person can recover $500 per violation (or their actual loss, if greater), and a court can raise that to as much as three times for a willful or knowing violation (47 U.S.C. § 227(b)(3)). This isn’t legal advice; check your obligations with counsel.
What doesn't ZeroSettle publish yet?
ZeroSettle does not yet publish a monthly send-success rate, p95 send latency, webhook delivery success or an incident history, and has not announced a date for them. Until it does, measure your own line (method):
- Time each
POST /api/imessage/sendcall and log its result orerror.code; that gives you your own median and p95 send time. - Count
message.sentandmessage.failedevents at your webhook each day; sent divided by sent plus failed is your send-success rate. - Log the live stream's
deliveryevents, one per webhook attempt withok,status_codeandattempts, or checklast_deliveryinGET /api/imessage/linefor the newest delivery.
New to the product? Read what ZeroSettle is and the API docs, compare plans, or get a number.
Frequently asked questions
Can I get my money back if ZeroSettle isn't reliable enough for me?
Yes, within 30 days of subscribing: ask and you are refunded in full and the subscription is cancelled. The guarantee covers the subscription, not AI credit packs. ZeroSettle publishes no SLA; the 99.9% figure is a homepage stat, not a commitment.
Where can I see incidents?
ZeroSettle doesn't publish an incident history yet. The API reports failures directly, as 503 responses and message.failed events, and the live stream reports every webhook attempt.
Is my data encrypted end to end, and how long is it kept?
ZeroSettle doesn't claim end-to-end encryption; its terms say content may not be encrypted. Messages are kept indefinitely for now, and DELETE /api/imessage/conversations/{handle} removes one contact's stored messages without unsending anything.
Who do I contact about security reviews?
Email founders@zerosettle.io. The homepage lists “SOC 2, DPA and security reviews” as part of the Enterprise plan; ZeroSettle doesn't publish a SOC 2 report or certification.
Sources
- ZeroSettle iMessage API docs: “Send a message”, “Webhooks, step by step”, “Live stream (SSE)” and “Errors, limits, and compliance”. Checked October 8, 2026.
- zerosettle.io homepage: the “99.9% uptime” and “10,000+ messages/week” stats, plans, and the FAQ “What if a number does get marked as spam?”. Checked October 8, 2026.
- ZeroSettle iMessage API Terms, sections 2, 5, 13 and 14. Last modified September 28, 2026.
- Twilio APIs Service Level Agreement, Twilio. Updated April 9, 2026; checked October 8, 2026.
- View and recover spam messages on your iPhone, Apple Support. Checked October 8, 2026.
- 47 U.S. Code § 227, Restrictions on use of telephone equipment, Legal Information Institute, Cornell Law School. Checked October 8, 2026.
Changelog
- First published. Next review: quarterly, or sooner after an incident or new data.
- Updated Pro’s new-contact limit to 5 a day per number and the STOP description; added a legal note.