AWS End User Messaging vs Prelude

AWS End User Messaging 85

Closed service under the AWS Customer Agreement and section 29 of the Service Terms, with Apache-2.0 SDKs (20 of 30). The guide says messages are processed and stored in the Region the customer picks and encrypted at rest with service-owned keys, and both the guide and the sub-processor page say downstream carriers may route messages through other regions. We found no retention period for message data (18 of 30). Amazon Pinpoint's end of support on 30 October 2026 carried dated notices (no new customers from 20 May 2025, end of support on 30 October 2026) that say these messaging APIs continue, and the document history dates each change. No general deprecation policy found (15 of 20). The sub-processor page, last updated 28 July 2026, names the entities that sell the service and promises 30 days' notice of new ones, but the downstream carriers are not named (17 of 20).

Prelude 42

Closed service whose general terms are a Notion page drawn by script, which we couldn't read; the SDKs are Apache-2.0 (8 of 30). The privacy policy is also unreadable for the same reason, and the trust centre names no retention periods or data locations (3 of 30). v1 and v2 are documented side by side and the changelog dates changes by month, with no deprecation policy found (6 of 20). No sub-processor list or data locations found (0 of 20). 8 + 3 + 6 + 0 = 17.

AWS End User Messaging 88

IAM with policies per action and resource ARN, service condition keys, temporary credentials and rotation. No secret travels in a URL (30). Policies can allow a single send action on one phone number or pool, and enforced spend limits, protect configurations and deletion protection bound what a credential can do. We found no read-only managed policy for the service and no confirmation step (15 of 20). API responses carry no third-party content. Inbound SMS and RCS go to an SNS topic or Connect Customer, not through API calls (10). CloudTrail logs control-plane calls as management events and the send actions as optional data events, and configuration sets publish per-message events (15). In scope for SOC 1, 2 and 3 (page updated 11 August 2026), with a vulnerability disclosure programme on HackerOne. aws.amazon.com's security.txt was renewed and now runs to 16 October 2027. No paid bug bounty was found, per the 8 October check, not re-read on 17 October. Read as the Amazon SES and Secrets Manager re-checks of 17 October read the same evidence (18 of 20).

Prelude 63

API keys as bearer tokens with no scopes found; the MCP server uses OAuth with a per-user consent screen (20 of 30). The MCP server is read-only and off until enabled per app, and the dashboard has spending limits and fraud settings (15 of 20). Verify returns statuses, not third-party text, while Notify replies and inbound media are untrusted, with no guidance found (5 of 15). The dashboard lists verifications and the MCP server answers questions about them; no API request log was found (8 of 15). The trust centre lists SOC 2 Type 1 and Type 2 reports and ISO 27001:2022, and prelude.so has a valid security.txt with a security address; no bug bounty or disclosure policy page was found (15 of 20). 20 + 15 + 5 + 8 + 15 = 63.

AWS End User Messaging 71

No dedicated MCP server. The AWS MCP Server with the aws-sms-voice skill covers guidance and can run the API calls. Send responses return only a MessageId, and 28 list actions take MaxResults (1 to 100) and NextToken (15 of 25). Describe actions take Filters and resource ID lists (16 of 20). Seven typed errors, with reason codes on conflicts (41 values), validation failures (43, plus the failing fields) and quota errors (28) (18 of 20). ClientToken on 15 create and request actions and DryRun on sends, but no idempotency token on SendTextMessage, SendMediaMessage or SendRcsMessage, so a retried send can go out twice (10 of 20). SendTextMessage requires only the destination number, and SDKs exist in every major language, but every call needs SigV4 and a first send needs a registered sender (12 of 15).

Prelude 85

List calls take limit from 1 to 200 with cursor or offset; the MCP server's tool list isn't on the docs page, so its size is unchecked (18 of 25). Cursor and offset pagination with filters (18 of 20). Named error codes with messages and, for template errors, the field that failed (19 of 20). Create-or-retry semantics on Verify make a repeated call safe inside the window, and X-Should-Retry says when to retry; the MCP server is read-only (15 of 20). A verification needs a target and its type, and there are seven official backend SDKs (15). 18 + 18 + 19 + 15 + 15 = 85.

AWS End User Messaging 73

AWS Health Dashboard with per-service, per-Region history (20). AWS's dashboard history file, re-read on 1 November, still lists AWS End User Messaging in the Middle East (UAE) me-central-1 and Middle East (Bahrain) me-south-1 multi-service events, open since 1 and 2 March 2026 at disruption status, with no update after 15 September. On that date, inside the 90-day window from 3 August, AWS said it can't restore resources and data hosted only in me-south-1 or the mec1-az2 zone. No other event in the window names the service, and the newest event in the file is an API Gateway one in us-west-2 posted on 30 October. One major event, read as the Amazon S3, Secrets Manager and Transcribe re-checks of 1 November read the same two events (10). Quotas page gives 1 request a second for most actions, SendTextMessage included (re-read 1 November), and the throughput page gives message parts a second by sender type (15). The API model marks ThrottlingException as retryable and 15 create and request actions take a ClientToken, but the send actions take no idempotency token and we found no backoff guidance in the guide pages we read (8). The AWS User Engagement SLA commits 99.9 per cent monthly uptime per Region and names AWS End User Messaging, per the 8 October check (10). Generally available (10). 20+10+15+8+10+10 = 73.

Prelude 65

Read with the hosted lines. status.prelude.so has components for Verify, Auth, Watch, Intel, Notify and the dashboard, with history (20). From 8 August to 6 November its feed records one major incident, increased error rates and latencies across the APIs on 16 and 17 August, posted after it was resolved with no duration stated, and minor ones such as Verify latency on 9 and 10 August, SMS degradation in China and on Orange France and delayed webhooks on 23 October (10). No numeric API rate limits were found; only the MCP server's limits and per-window Verify retry limits are documented (7 of 15). A 429 carries Retry-After and X-Should-Retry, and repeating the create call inside the window performs a retry rather than a new verification (13 of 15). The pricing page lists a 99.95 SLA on Enterprise with no SLA document found (5 of 10). Verify and Notify v2 are generally available (10). 20 + 10 + 7 + 13 + 5 + 10 = 65.

AWS End User Messaging 88

No OpenAPI, but the Smithy models for both APIs are published in aws/api-models-aws, 110 operations for SMS and Voice v2 and 38 for Social Messaging (25). llms.txt for the user guide and the API reference, with Markdown twins of every page (10). The API reference explains each action, and the guide says when to use Notify and when standard sending. Few actions say when not to use them (12 of 20). 69 enumerated types, length limits and patterns on phone numbers and message bodies, required members marked (14 of 15). The guide carries CLI and Python examples and each action lists its errors, but the SendTextMessage reference page has no examples section (12 of 15). Versioned API (2022-03-31) and a dated document history, whose newest entry is still 22 September 2026 on 1 November (15).

Prelude 93

OpenAPI for the 27 SDK endpoints is public at the URL in the SDK repository's .stats.yml, and every reference page embeds its endpoint's OpenAPI (25). llms.txt and Markdown pages (10). Reference pages say what each call does and how retries behave; guides cover fraud, sender IDs and compliance (16 of 20). Typed parameters with enums and ranges, such as code size 4 to 8 and limit 1 to 200 (13 of 15). Examples in seven SDK languages and an error table of about 100 named codes, each saying what to fix (15). Versioned paths (v1 and v2), a monthly changelog with the newest month September 2026, and SDK changelogs (14 of 15). 25 + 10 + 16 + 13 + 15 + 14 = 93.