No badge wall.
Here's the actual architecture.
We can't hand you a SOC 2 report for your deployment, because your deployment isn't ours to audit. What we can do is publish how the system works, what's encrypted where, and what we can and cannot see. All of it on this page, with no form in front of it.
It runs inside the environment you already had audited.
A self-hosted PBX doesn't add a new vendor to your data-processing register. Your calls terminate on your server, your recordings sit in your bucket, your CDRs live in the system's own Postgres on your disk. The compliance surface is your own infrastructure, which your auditors have already seen.
Where the audio actually goes.
Browser softphone legs run WebRTC with DTLS-SRTP: encrypted media between the browser and your server, with ICE-Lite for traversal.
The control plane (signalling between components, and the admin API) runs over TLS, with the internal media protocol carried on QUIC.
Desk-phone legs on your LAN are standard RTP on your own network, the same as every on-premise PBX ever sold. In a self-hosted deployment that traffic never touches the internet.
The sentence most vendors won't write: if you register a SIP handset across the public internet, put it on your VPN. We say that in the docs, plainly, rather than letting you assume something we didn't build.
Authentication is SIP Digest (MD5 and SHA-256) with realm-correct enforcement, and STIR/SHAKEN call identity on trunks that support it.
The complete outbound inventory.
"We can see nothing" is the kind of absolute that deserves suspicion, so here is the scoped version instead.
This is a topology you can check, not a policy you have to trust. Put tcpdump on the box and watch.
Who holds which keys.
What we do on our side.
Certifications for the hosted tier are on the roadmap. We'll publish auditor and dates when engaged, not logos before then. A claim you can't verify yet is a claim we won't print.
Found something?
Report vulnerabilities to [email protected]. A human engineer reads that inbox. We acknowledge within two business days, keep you informed, and credit you if you want credit.
Please don't test against systems you don't own. That's what the free self-hosted tier is for.