AWS End User Messaging vs Kudosity

AWS End User Messaging 88

IAM with policies per action and resource ARN, service condition keys, temporary credentials and rotation. No secret travels in a URL (30). Policies can allow a single send action on one phone number or pool, and enforced spend limits, protect configurations and deletion protection bound what a credential can do. We found no read-only managed policy for the service and no confirmation step (15 of 20). API responses carry no third-party content. Inbound SMS and RCS go to an SNS topic or Connect Customer, not through API calls (10). CloudTrail logs control-plane calls as management events and the send actions as optional data events, and configuration sets publish per-message events (15). In scope for SOC 1, 2 and 3 (page updated 11 August 2026), with a vulnerability disclosure programme on HackerOne. aws.amazon.com's security.txt was renewed and now runs to 16 October 2027. No paid bug bounty was found, per the 8 October check, not re-read on 17 October. Read as the Amazon SES and Secrets Manager re-checks of 17 October read the same evidence (18 of 20).

Kudosity 37

One account-wide API key on V2 and Basic auth with the key and a secret the user types in on V1, both in headers. No scopes, read-only keys or rotation steps were found (12 of 30). No least-privilege mode. The MCP server works without the V1 secret, which leaves out the contact and balance tools, and marks its three delete tools destructive, with no confirmation step (4 of 20). Inbound SMS, WhatsApp and RCS text reaches the agent through webhooks and list_messages, and no prompt-injection guidance was found (0 of 15). Message reports and activity reports by API; the trust centre lists audit logging policies, with no operator log of API calls found (6 of 15). ISO/IEC 27001:2022 and SOC 2 Type 2 stated on kudosity.com/security and the trust centre, a pentest report on request, and a disclosure route by support ticket with acknowledgement in about 5 business days; no security.txt or bug bounty (15 of 20). 12 + 4 + 0 + 6 + 15 = 37.

AWS End User Messaging 85

Read by the listing's own service models, as this run's amazon-s3 and amazon-transcribe re-checks were. The Social Messaging model last changed on 19 October 2026 (Direct Send enforcement status on WhatsApp Business Accounts, and template source and corrected category on templates), 13 days before this check, and the SMS and Voice v2 model on 12 October (a PricingTier field on DescribePhoneNumbers and DescribeSenderIds). The models repository had commits to 30 October with none touching either model since (30). In the 90 days from 3 August, SMS and Voice v2 changed on 31 August, 8 September, 2 October and 12 October, and Social Messaging on 6 August, 3 September, 17 September and 19 October, with guide changes dated 8, 15 and 22 September (20). The JavaScript clients ship with the whole SDK (3.1161.0 on 30 October) and aren't needed for the count. Closed service with a dated document history and AWS re:Post. Direct support is a paid plan (10 of 15). Official SDKs released on most working days (15). The JavaScript client needs Node 20 or later and is published from the SDK's release pipeline (10). 30+20+10+15+10 = 85.

Kudosity 57

kudosity-mcp 0.5.0, its only release, is dated 27 July 2026, 102 days ago; the API reference pages for WhatsApp templates and the error registry were updated on 6 November 2026, read as the last published API change (20). The changelog's six newest entries carry no dates. Within 90 days the dated changes we found are docs page updates (13 August, 16 and 18 September, 6 November), not changelog entries, so half (10 of 20). Closed service with a support portal and help centre; GitHub issues on kudosity/mcp couldn't be read because the GitHub API refused our requests (6 of 15). com.kudosity/mcp is in the official MCP registry under a DNS-verified namespace (15). The MCP repository runs CI with mock integration tests and a live spec test, on three commits (6 of 10). 20 + 10 + 6 + 15 + 6 = 57.

AWS End User Messaging 85

Closed service under the AWS Customer Agreement and section 29 of the Service Terms, with Apache-2.0 SDKs (20 of 30). The guide says messages are processed and stored in the Region the customer picks and encrypted at rest with service-owned keys, and both the guide and the sub-processor page say downstream carriers may route messages through other regions. We found no retention period for message data (18 of 30). Amazon Pinpoint's end of support on 30 October 2026 carried dated notices (no new customers from 20 May 2025, end of support on 30 October 2026) that say these messaging APIs continue, and the document history dates each change. No general deprecation policy found (15 of 20). The sub-processor page, last updated 28 July 2026, names the entities that sell the service and promises 30 days' notice of new ones, but the downstream carriers are not named (17 of 20).

Kudosity 62

Closed service with clear terms from Known Pty Ltd (23 September 2026); the MCP server is MIT (17 of 30). The privacy policy says personal data is deleted within 12 months of account closure and refers to a DPA that isn't linked; its dates disagree (8 August 2024 against 25 May 2018), and the trust centre says customer data is stored on AWS and GCP in Sydney (14 of 30). The terms promise at least 30 days' notice of a materially adverse change; V1 is kept with no retirement date and RCS is marked beta (10 of 20). Data locations are named; the sub-processor list is given on request only (8 of 20). 17 + 14 + 10 + 8 = 49.

AWS End User Messaging 73

AWS Health Dashboard with per-service, per-Region history (20). AWS's dashboard history file, re-read on 1 November, still lists AWS End User Messaging in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status, with no update after 15 September. On that date, inside the 90-day window from 3 August, AWS said it can't restore resources and data hosted only in me-south-1 or the mec1-az2 zone. No other event in the window names the service, and the newest event in the file is an API Gateway one in us-west-2 posted on 30 October. One major event, read as the Amazon S3, Secrets Manager and Transcribe re-checks of 1 November read the same two events (10). Quotas page gives 1 request a second for most actions, SendTextMessage included (re-read 1 November), and the throughput page gives message parts a second by sender type (15). The API model marks ThrottlingException as retryable and 15 create and request actions take a ClientToken, but the send actions take no idempotency token and we found no backoff guidance in the guide pages we read (8). The AWS User Engagement SLA commits 99.9 per cent monthly uptime per Region and names AWS End User Messaging, per the 8 October check (10). Generally available (10). 20+10+15+8+10+10 = 73.

Kudosity 85

Read with the hosted lines. status.transmitsms.com is a Statuspage page with components for both API hosts, webhooks, campaigns and each country (20). Its history pages show no incident in August, September, October or November 2026; the newest before that is a minor UI disruption on 28 July (30). 15 calls a second per account, documented (15). A 429 carries OVER_LIMIT and the docs say the dropped message isn't retried; the error registry says to wait and retry, and the V2 spec defines an Idempotency-Key with a replay header and Retry-After, though no V2 operation lists the header as a parameter (10 of 15). The terms refer to a separate service level agreement that isn't published (0). SMS, MMS and WhatsApp on V2 are generally available; RCS is marked beta (10). 20 + 30 + 15 + 10 + 0 + 10 = 85.