Every Cleat line belongs to a real, verified person. Here's why.

How verification works

1. 01You verify before you can buy a line, from your account. You only do it once.
2. 02Stripe checks a government ID and a selfie. It takes about two minutes.
3. 03Prefer not to take a selfie? Choose the ID-only option. Stripe checks the document, and a person at Cleat reviews the result before you can check out. Every decision is recorded with a reason, and we email you the outcome.
4. 04Once you're verified, you subscribe, and your number is live right away.

What we keep, and what we don't

Your ID document and selfie go to Stripe, which checks them. We receive the outcome and a reference to the check, not copies of your ID or selfie. When a person reviews an ID-only check, they read Stripe's result live, such as the document type, issuing country and expiry date. Cleat doesn't store ID images.

Stripe provides identity verification to Cleat as a service provider; Stripe's privacy policy explains how it handles your information. What Cleat collects, and how long we keep it, is in our Privacy Policy.

What we refuse

Cleat is a receive-only line for your own accounts and your team's. Our Terms rule out using it to:

• break the law, or help someone else do so;
• commit fraud, misuse someone's identity, or impersonate a person or business;
• receive texts meant for someone else without their permission;
• get around a sanctions rule or a lawful investigation;
• resell lines or access without our written permission.

We may suspend or close accounts that do. Because identity is the point, verifying on someone else's behalf isn't allowed either: we can refuse, pause or remove access to lines when a check fails, looks fraudulent, or was done for someone else.

What a Cleat line is, and isn't

• A real US mobile number that receives texts, and transcripts of incoming calls. Not VoIP and not a virtual number. How that's different.
• Receive-only: no outbound calls or texts, and no 911. An incoming call reaches you afterwards, transcribed, never as a ringing phone.
• Assigned from available US inventory. You can't choose the area code.
• Yours while you subscribe. When billing ends, the number is held for 30 days, then released, and it may later be given to someone else.
• Not a guarantee. Most services that turn away VoIP accept a real mobile line, but no provider can promise that every service accepts every number.

Security basics

Only what Cleat does today:

• Connections are encrypted, and browsers are told to use HTTPS only.
• Passwords are stored as one-way hashes. Changing yours signs you out everywhere else.
• API keys are shown once, stored only as hashes, and can be revoked. Webhook signing secrets are shown once too.
• Webhooks are signed with a timestamp, so your endpoint can check that a delivery came from Cleat and isn't a replay.
• Texts are visible only to members of the workspace that owns the line. Remove a teammate and they stop seeing texts immediately.
• Sign-in attempts and API requests are rate limited.
• No advertising or tracking cookies, and we don't sell your data.

Who runs Cleat

Cleat is operated by Hyppe Tech LLC, a US company. Write to us at contact@cleat.so.