Ask HN: How to do transactional SMS as a bootstrapped or startup company?
55 comments
SMS has become a huge pain to send, because of spam. I ran into this with my steampunk telegraph office. We ran a telegraph office at steampunk conventions, where attendees could send in a message via SMS, and it was typed out on an antique teletype machine. A messenger at the con would then deliver a proper telegram in person.[1] I recruited some young actors to run the office, and it was a hit.
This used Twilio. Users sent an SMS to Twilio. Twilio then made an HTTP request to our server, which queued the message for the Teletype machine and replied to the sender with an SMS message. This is what Twilio calls inbound SMS - text comes in, reply goes back in the HTTP reply. You can't send unsolicited SMS via the inbound system. It's a unit transaction.
This now has to be registered as an "advertising campaign". There's an additional per-month fee, and a vetting process. You have to have an identifiable company. I could go through all that to comply, but steampunk is pretty much over and we stopped doing cons when COVID hit.
The spam industry effectively defines a "transactional message" as someone messaged in once, so now you can spam them forever. ("Now you can buy more of that thing you bought last year!") Regulation now works on that basis. So even services that are inherently one request/reply are regulated as "ad campaigns."
This is why we can't have nice things.
[1] https://vimeo.com/124065314
This used Twilio. Users sent an SMS to Twilio. Twilio then made an HTTP request to our server, which queued the message for the Teletype machine and replied to the sender with an SMS message. This is what Twilio calls inbound SMS - text comes in, reply goes back in the HTTP reply. You can't send unsolicited SMS via the inbound system. It's a unit transaction.
This now has to be registered as an "advertising campaign". There's an additional per-month fee, and a vetting process. You have to have an identifiable company. I could go through all that to comply, but steampunk is pretty much over and we stopped doing cons when COVID hit.
The spam industry effectively defines a "transactional message" as someone messaged in once, so now you can spam them forever. ("Now you can buy more of that thing you bought last year!") Regulation now works on that basis. So even services that are inherently one request/reply are regulated as "ad campaigns."
This is why we can't have nice things.
[1] https://vimeo.com/124065314
Wow what an awesomely nice thing to have that bridge at a steampunk. Never would have thought of it but now makes me want to send a telegram and shock the recipient with the retro-ness!
That was a fun project, from the TechShop/maker era.
"Anyone can be punk, but to be steampunk you need a good tailor and access to a machine shop."
"Anyone can be punk, but to be steampunk you need a good tailor and access to a machine shop."
This is almost certainly a Peer to Peer use case, despite what The Campaign Registry might claim.
1 to 1 conversations where the user is contacting you is hard to argue as anything but P2P, you would be best off with a P2P texting enablement provider or toll free texting.
1 to 1 conversations where the user is contacting you is hard to argue as anything but P2P, you would be best off with a P2P texting enablement provider or toll free texting.
Yes but now that the telcos have collected the monthly fee, we don't have anymore spam problems! /s
If you think you are going to do an endrun around push notifications by just using SMS instead, you are going to run into a lot of user friction and technical challenges. Just figure out how to do push notifications.
SMS is so incredibly locked down and rate limited at this point you shouldn't reasonably expect to send much more than 1 SMS per user with an activation code if you want to do phone number verification.
SMS is so incredibly locked down and rate limited at this point you shouldn't reasonably expect to send much more than 1 SMS per user with an activation code if you want to do phone number verification.
SMS is also insanely expensive compared to push.
I had a bootstrapped B2B company that was stuck in a similar situation, lot of transactional SMS. We initially used (started over a decade ago now) SMS gateways like [email protected] before we had a mobile app. These worked great for a while, but in the last few years they have become very unreliable.
So we started really driving people to push notifications, but users liked the text messages. Especially if they believe your messages are important. As the gateways become more unreliable, users became frustrated and weren't interested in switching over to push notifications.
I did all the research you did, and while we were profitable taking on SMS was going to become a major cost. I couldn't do it. So we took these steps:
1. Immediately stopped providing SMS gateway texts to all new customers. This stopped the expectation that text messages were included. These customers were told we only had push notifications.
2. We went with Twilio and with our decade of data we had a good idea how many text messages per customer. We begin offering a new package that included text messages. We really didn't mark up the price at all, we just covered costs.
When a customer would complain about only have push notification option, we sold them the text message package. When the SMS gateways were unreliable for a customer, we sold them the text message package.
The product is still sold like this today.
So we started really driving people to push notifications, but users liked the text messages. Especially if they believe your messages are important. As the gateways become more unreliable, users became frustrated and weren't interested in switching over to push notifications.
I did all the research you did, and while we were profitable taking on SMS was going to become a major cost. I couldn't do it. So we took these steps:
1. Immediately stopped providing SMS gateway texts to all new customers. This stopped the expectation that text messages were included. These customers were told we only had push notifications.
2. We went with Twilio and with our decade of data we had a good idea how many text messages per customer. We begin offering a new package that included text messages. We really didn't mark up the price at all, we just covered costs.
When a customer would complain about only have push notification option, we sold them the text message package. When the SMS gateways were unreliable for a customer, we sold them the text message package.
The product is still sold like this today.
I like this approach. Customers should be paying for relatively expensive options like SMS if they prefer it.
It is my decision whether your notification is worth my time. If you're using SMS because you don't think that I'll give you push notification permission then that tells you that I literally do not want them (save your monthly fees too :) ).
I built an app for myself that I’ve been considering rolling out as a product. It’s built around SMS because I will always look at a text message but app notifications are constant and easy to ignore. But the whole idea of the product is built around not being able to ignore the thing the app tracks for you. So far in a limited release the only thing I’ve learned is that my free tier needs to be quite limited and that it’s going to cost a few bucks per month per user to run it, so I need to charge more than that. But you’re effectively paying to be texted about something specific. It’s not because you don’t want to opt into push notifications - it’s because you’re literally paying for something to cut through the noise. Im not OP but if they’ve got something similar going on, that’s a good reason to use SMS.
That said your concern is incredibly valid and it’s why SMS needs to remain somewhat expensive. Could you imagine if SMS was as cheap as email? Holy shit the spam volume.
That said your concern is incredibly valid and it’s why SMS needs to remain somewhat expensive. Could you imagine if SMS was as cheap as email? Holy shit the spam volume.
> I will always look at a text message but app notifications are constant and easy to ignore
I ignore texts from people I don't know (not in my address book).
I ignore texts from people I don't know (not in my address book).
When you say "ignore" do you mean a) you see it, read it, then delete/ignore it; b) you see it, see you don't recognize, and delete/ignore without reading; or, c) you never see it because of app/OS settings filtering it?
I am pretty solidly in camp A, I will read every text message that hits my phone but if it's spam or something like that I will just get pissed off and remember not to give that company/person any money ever. But I still read it.
I am pretty solidly in camp A, I will read every text message that hits my phone but if it's spam or something like that I will just get pissed off and remember not to give that company/person any money ever. But I still read it.
I have disabled message notifications from unknown senders. If I'm expecting one (e.g. an activation or 2FA code) I just watch for it.
You might consider using the free email to SMS addresses that major cell providers support:
AT&T [email protected]
Boost Mobile [email protected]
Cricket Wireless [email protected]
Google Fi [email protected]
MetroPCS [email protected]
Sprint [email protected]
T-Mobile [email protected]
US Cellular [email protected]
Verizon [email protected]
Virgin Mobile [email protected]
AT&T [email protected]
Boost Mobile [email protected]
Cricket Wireless [email protected]
Google Fi [email protected]
MetroPCS [email protected]
Sprint [email protected]
T-Mobile [email protected]
US Cellular [email protected]
Verizon [email protected]
Virgin Mobile [email protected]
Deliverability on these gateways can vary greatly
I'd go a step further: deliverability with these gateways is poor even for small-scale personal use, and they will stop working entirely if you try to use them for bulk SMS. They are not a replacement for an SMS provider.
I've seen even transactional email providers like sendgrid block that verizon email, tough to trust.
During the heyday of feature phones, I always enjoyed that these existed. I could text people from my blackberry without worrying about exceeding my sms plan allowance.
< If user does not want to use the phone, then maybe the service is not for them.
That seems like a silly hill to die on. How is SMS any different than an email in simplicity?
That seems like a silly hill to die on. How is SMS any different than an email in simplicity?
Don’t understand why this has been downvoted.
It is a very silly hill to die on. Phone numbers are garbage. Difficult to change (banks/govt/emergency contact/ etc), difficult to mask (ala no “hide my email” alternative), and extremely invasive (no ability to customise notifications per sender/caller). So yeah, it’s no wonder people are becoming more and more wary of giving their phone number out.
When the alternatives such as email and push are so simple, it really doesn’t make sense why the OP is willing to lose potential customers because of some weirdly held opinion.
It is a very silly hill to die on. Phone numbers are garbage. Difficult to change (banks/govt/emergency contact/ etc), difficult to mask (ala no “hide my email” alternative), and extremely invasive (no ability to customise notifications per sender/caller). So yeah, it’s no wonder people are becoming more and more wary of giving their phone number out.
When the alternatives such as email and push are so simple, it really doesn’t make sense why the OP is willing to lose potential customers because of some weirdly held opinion.
Insisting your users give you their phone numbers gives you some basic anti-spam protection, gives you strong tracking info for ad purposes, and makes account recovery the telco’s problem.
If cost is prohibitive, and you cannot pass it on to the users, you could consider using email instead. Where you would ask for a phone number, ask for an email address instead. Where you would send an SMS, send an email instead.
Tier 1 is good, but caring about 300-500 euros is not a "tier 1" sort of budget for pretty much anything. You can't get a reasonable amount of AWS compute for that for example.
I'd look into country specific providers. They tend to be much cheaper, and the APIs often won't be terrible. SMS has the advantage of being fairly straightforward too (where say, payments is not).
I've used Twilio and I've used a local alternative, and there was really very little difference in practice for a startup level of reliability and feature set. The trade-off with local providers is time, and the bootstrap trade-off is time instead of money, so they're well aligned.
I'd look into country specific providers. They tend to be much cheaper, and the APIs often won't be terrible. SMS has the advantage of being fairly straightforward too (where say, payments is not).
I've used Twilio and I've used a local alternative, and there was really very little difference in practice for a startup level of reliability and feature set. The trade-off with local providers is time, and the bootstrap trade-off is time instead of money, so they're well aligned.
Twilio is incapable of approving the simplest A2P campaigns in a reasonable timeframe. A2P approval is contingent on Twilio support staffers review of your company’s privacy policy, and they will reject your campaign for merely having the presence of the word “share” somewhere in the policy. The reviewers aren’t legal: they will “Ctrl-F”“share” and then send you screenshots with the rejection. They aren’t able to interpret the context in which the word appears. It’s simply a rejection.
After 4 months of run around, we gave up on Twilio and SMS. I’m furious with Twilio and will never use them again.
After 4 months of run around, we gave up on Twilio and SMS. I’m furious with Twilio and will never use them again.
The Campaign Registry cartel formed by the big 3 wireless carriers artificially contrived A2P and is currently trying to milk SMS using companies for as much money as they can.
You can opt out by using a toll free number to send SMS (which is 10DLC exempt), use a P2P carrier (read: Not Twilio), or use a carrier that will let you ride their 10DLC registration (which was what Twilio was probably doing if you don't have an LLC). Not all are as awful to deal with as Twilio!
You can opt out by using a toll free number to send SMS (which is 10DLC exempt), use a P2P carrier (read: Not Twilio), or use a carrier that will let you ride their 10DLC registration (which was what Twilio was probably doing if you don't have an LLC). Not all are as awful to deal with as Twilio!
[deleted]
SMS costs vary by destination. If you're US focused, expect to pay about 1 cent per message; if you're globally focused, it's more like 10 cents.
Unless you've got revenue or some sort of long term value associated with your messages, you've got to use them sparingly. If you have huge volume, you can get lower prices, all the way down to zero cost in some cases, but as a small user, you're going to pay real money, especially internationally.
You can try messing around with abusing a consumer account's free messaging, but you'll hit limits quickly.
If possible, have a plan to use multiple providers, monitoring delivery, and switching traffic as needed. Every provider in this space will tell you they have global coverage, that they have direct routes and don't use aggregators, and they're all lieing. You need flexible routing to manage this, and SMS is a very simple API target, so it's easy to integrate alternatives; there are a lot of country specific requirements for commercial messaging, so the providers are providing a real service, but it's replicatable and the tier 1 group is big, although you've missed several and included some I wouldn't count as tier 1.
Unless you've got revenue or some sort of long term value associated with your messages, you've got to use them sparingly. If you have huge volume, you can get lower prices, all the way down to zero cost in some cases, but as a small user, you're going to pay real money, especially internationally.
You can try messing around with abusing a consumer account's free messaging, but you'll hit limits quickly.
If possible, have a plan to use multiple providers, monitoring delivery, and switching traffic as needed. Every provider in this space will tell you they have global coverage, that they have direct routes and don't use aggregators, and they're all lieing. You need flexible routing to manage this, and SMS is a very simple API target, so it's easy to integrate alternatives; there are a lot of country specific requirements for commercial messaging, so the providers are providing a real service, but it's replicatable and the tier 1 group is big, although you've missed several and included some I wouldn't count as tier 1.
$300-500/mo seems very cheap to reliably contact 1000 users directly on their phones and have them respond in almost all cases.
It costs money because it's valuable. Sign up for one of the Tier 1 services and move on, if you can't justify the cost you need to reassess your product and/or its pricing.
It costs money because it's valuable. Sign up for one of the Tier 1 services and move on, if you can't justify the cost you need to reassess your product and/or its pricing.
For your use case I think e-mail is the best option. One scrappy alternative I've used with success in the past is to use a messaging app like Telegram. I needed push notifications for a small website but all the "Push apps" (like Pushover) that I found were quite expensive. Telegram is free with a simple but powerful API. However, this is only viable if your users are either from a country that already uses said app a lot, or like your site enough that they are willing to download an extra app for it. I wouldn't recommend it as a required thing but only a bonus. Now that browsers support push I've been using that, but for iOS it's still a bit painful and doesn't play well with my site that uses many subdomains.
Brevo is wonderful and easy. And has some free tier going on. Not sure about how it compares pricewise at this exact instant but I reckon it's gonna save you hard-earned buckaroos (American for money).
Charge customers more to offset the cost. Pricing doesn’t get lower than AWS SNS.
SMS as a 2FA method is flawed (but better than no 2FA). I’d push users into more secure options. Doing so can also lower SMS cost.
SMS as a 2FA method is flawed (but better than no 2FA). I’d push users into more secure options. Doing so can also lower SMS cost.
> However, based on my initial calculations, even with 1000 users signing up. Allowing SMS code input and DM messages or info messages, these can reach a number of close to 300 to 500 Euros or Dollars monthly. This is including alpa numeric sending options. Where I do not allow messages to be replied back.
At what service? How did you come up with the number $300-500.
The prices will differ greatly depending on what countries you send to. (e.g. Twilio is $0.0079/sms to the US, but $0.0578/sms to Sweden)
At what service? How did you come up with the number $300-500.
The prices will differ greatly depending on what countries you send to. (e.g. Twilio is $0.0079/sms to the US, but $0.0578/sms to Sweden)
Bootstrapping….Get a phone and interface it to the cloud to send and receive the messages you want. Android will have some way of sending and receiving messages from it. Just be mindful of the rate limits and any roles and regulations, but for a small implementation you should be ok.
There’s another great example in the comments to email a phone number of you know what the provider is. Porting has made guessing this a little harder.
There’s another great example in the comments to email a phone number of you know what the provider is. Porting has made guessing this a little harder.
Understand the Telephone Consumer Protection Act.
Professional plaintiffs will eventually sue you for minor TCPA violations, and will not be cheap to resolve.
Professional plaintiffs will eventually sue you for minor TCPA violations, and will not be cheap to resolve.
Twilio SMS is very affordable in the US.
Most countries outside US/CAN use WhatsApp as the preferred method of messaging, which is considerably cheaper. https://www.twilio.com/en-us/whatsapp/pricing
Most countries outside US/CAN use WhatsApp as the preferred method of messaging, which is considerably cheaper. https://www.twilio.com/en-us/whatsapp/pricing
I haven’t worked with them in a few years, and I’ve never used their SMS features, so I can’t promise they will be a good fit, however I’ve worked with DIDWW for a while and they were significantly cheaper than Twilio.
I only used them for DID hosting and SIP trunking/local call termination.
I only used them for DID hosting and SIP trunking/local call termination.
How many messages are you expecting to send? 300 - 500 USD/mo suggests hundreds of thousands of messages. Are you expecting thousands of users? If so, any chance that some of your users will pay for your service?
In the USA.
But when you start sending sms internationally, the costs can explode.
As memory serves, twilio charges about 10c to send an sms to Germany, for example.
I run a bootstrapped and somewhat successful monitoring saas and we literally keep a running balance of every users sms cost (as reported directly by twilio) and every user has a $ cap that resets monthly.
But when you start sending sms internationally, the costs can explode.
As memory serves, twilio charges about 10c to send an sms to Germany, for example.
I run a bootstrapped and somewhat successful monitoring saas and we literally keep a running balance of every users sms cost (as reported directly by twilio) and every user has a $ cap that resets monthly.
What is the $ cap?
This estimate is also not taking into account carrier pass-thru fees, regulatory fees, phone number maintenance fees, etc. The idea that you can send 100K sms segments for a few hundred bucks just isn't true, even in the US. The pricing on these things gets way more complicated than what the marketing pages seem to indicate.
By way of example, my company is sending ~1.5M segments per month at a cost of a couple tens of thousands (I can't say exactly, obviously). This boils down to the fees that I mentioned, international examples that you gave, as well as the differences between SMS and MMS messaging where it's not always clear what counts as MMS (multi-byte encoding, anything with an attachment or URL, >N segments per message where N changes based on delivering carrier, etc.) It gets... Wonky.
By way of example, my company is sending ~1.5M segments per month at a cost of a couple tens of thousands (I can't say exactly, obviously). This boils down to the fees that I mentioned, international examples that you gave, as well as the differences between SMS and MMS messaging where it's not always clear what counts as MMS (multi-byte encoding, anything with an attachment or URL, >N segments per message where N changes based on delivering carrier, etc.) It gets... Wonky.
Yes, this is what I am seeing. The more the regulation, fees and others as the users grow, it does not feel like viable option after some time. Maybe building an app and using push notifications would be better
How much cost and complexity did 10DLC add for your use case?
Did you evaluate going all in on Toll Free texting perchance?
Did you evaluate going all in on Toll Free texting perchance?
I am expecting to send around 2000 messages a month as we scale. Yes, there are some paid tiers for enterprises but it is a long shot and is not immediate.
The man is building a business, can we keep it constructive for the fellow.
[deleted]
Push is far more reliable, you can get accurate delivery status, encrypt content and not be unnecessarily restricted by third parties (sms API provider, Telcos)
[deleted]
It honestly doesn't simplify things over push notifications all that much. There are a lot of regulations if you are planning on having users in the US around A2P (Automated to Personal) messaging. You have to register a brand and transactional use campaign with TCR (The Campaign Registry - the regulatory body that manages this messaging), a process that costs money and can take months. They are capricious to say the least... So expect a lot of upkeep on your website, brand, campaign, and number usage as time goes on and they change regulations more or less on a whim.
As part of those regulations you have to deal with opt-in and opt-out formalities. It's a crime in the US to send a text message to someone in an automated way that they did not directly and concretely ask for. Doing so can result in heavy fines. Similarly if they opt out using any of a number of both standard and non-standard methods, you must comply with that even if it impacts their ability to use other parts of your system. You can work around that with multiple numbers, each attached to a different campaign of a different use-case, but do that too much and they'll get you for "snow shoeing" and it comes with more and more fines.
And on... And on... And on... This is my literal day-to-day job. I can say with relative confidence that if you are working with a small number of people, just use push notifications. It's actually easier.
Also, if you must go with SMS for whatever reason, your tier-1 providers, as you put it, will handle a lot of that regulatory guff for you (for a price of course), so don't look too far for other providers. If you want to own your own registered brand and campaign with TCR, then a good option is Telgorithm, although your integration complexity will go up pretty drastically.
Lastly, check your costs. Pricing for SMS is way more complicated than what the marketing language on provider websites seem to indicate. Talk with people doing similar things and get the real answers, and budget accordingly.
As part of those regulations you have to deal with opt-in and opt-out formalities. It's a crime in the US to send a text message to someone in an automated way that they did not directly and concretely ask for. Doing so can result in heavy fines. Similarly if they opt out using any of a number of both standard and non-standard methods, you must comply with that even if it impacts their ability to use other parts of your system. You can work around that with multiple numbers, each attached to a different campaign of a different use-case, but do that too much and they'll get you for "snow shoeing" and it comes with more and more fines.
And on... And on... And on... This is my literal day-to-day job. I can say with relative confidence that if you are working with a small number of people, just use push notifications. It's actually easier.
Also, if you must go with SMS for whatever reason, your tier-1 providers, as you put it, will handle a lot of that regulatory guff for you (for a price of course), so don't look too far for other providers. If you want to own your own registered brand and campaign with TCR, then a good option is Telgorithm, although your integration complexity will go up pretty drastically.
Lastly, check your costs. Pricing for SMS is way more complicated than what the marketing language on provider websites seem to indicate. Talk with people doing similar things and get the real answers, and budget accordingly.
> It's a crime in the US to send a text message to someone in an automated way that they did not directly and concretely ask for. Doing so can result in heavy fines.
I get so many spam SMS messages on my US number, despite periodically registering my number on the do-not-call list. What's the best way to report numbers so that they get maximally penalized?
I get so many spam SMS messages on my US number, despite periodically registering my number on the do-not-call list. What's the best way to report numbers so that they get maximally penalized?
Not to mention the providers will not tell you the limits to avoid spammers flying just below them, but you might find out once all your T-Mobile customers start to fail (silently of course). You get that one random number on an MVNO which for some reason unknown to the SMS provider just can’t receive SMS from your numbers.
I had forgotten the production go-live for critical functions for our client got pushed back like 6 months due to short codes getting approved at seemingly random schedules until you mentioned the approval process. I do not miss working with SMS.
I had forgotten the production go-live for critical functions for our client got pushed back like 6 months due to short codes getting approved at seemingly random schedules until you mentioned the approval process. I do not miss working with SMS.
Now, ì do not want to get into Tier 2 also as the API approach ad DX is not available compared to how it is with Tier1. Also I don’t want to risk my customers phone numbers with providers who do not have good support and privacy handling features.
There are couple or more apps that I am building where I like the simplicity of SMS. I don’t have to request for push notification permissions, I do not need an app on the stores to push relevant info and updates. Most basic User signup. If user does not want to use the phone, then maybe the service is not for them. And then occasional updates on Direct messages on the platform. (Order completion, delivery instructions, Direct Messages from users etc.) I see most of these as small messages only if they ever did take actions on the platform.
However, based on my initial calculations, even with 1000 users signing up. Allowing SMS code input and DM messages or info messages, these can reach a number of close to 300 to 500 Euros or Dollars monthly. This is including alpa numeric sending options. Where I do not allow messages to be replied back.
When I started programming SMS was the cheapest option. Now I feel it has become expensive However I still see small and big companies using these options. 1. Are there other alternatives I am not seeing? 2. Since my volume of push and sending is low, I do not want to ask users push notification and scare them away 3. What other options can we see here.