Security
What we do to protect your phones and data, stated plainly.
Sign-in
Two-factor authentication for every app user and MSP admin. Secure, HTTP-only session cookies.
Calls in transit
Apps connect over TLS 1.2 or later with encrypted audio (SRTP). Calls to the public network use our carrier's network.
Data at rest
Voicemail, recordings and faxes are encrypted at rest. Backups are encrypted before they leave the source system.
Audit trail
Admin changes are logged. Remote console sessions on managed servers are recorded.
Toll-fraud limits
Outbound spending limits, and international calling off unless you ask for it.
On-prem agent
Outbound-only, with its own certificate. It only makes changes you start from the portal.
What we don't claim
Calls are encrypted between your device and our network, not end-to-end: our servers process audio to route calls and to record and transcribe them. We don't hold SOC 2 or ISO 27001 certification yet, and we don't sign HIPAA business associate agreements. If you need any of these, talk to us before you switch.
Report a vulnerability
Email [email protected] with details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access other customers' data or disrupt service while testing.