3rd Party Connection?

It is self contained for the email verification and will also be self contained when the mobile app is finished, to send sms it uses our own service wp2step.com. Your site sends no login details and wp2step keeps no information of any kind. All login data is verified on your site, wp2step simply receives the pin code, phone number, and API key to verify your account with them to ensure you are authorized to use the wp2step services. Great question, I will add this to our FAQ and the plugin FAQ as well.