Security
A €40,000 bill in one night. That is what we design against.
Telecoms fraud is not after your data: it is after your line. One extension whose password leaks makes thousands of calls to premium-rate numbers over a weekend, and the bill is legally yours. This page describes precisely what we do so that it does not happen.
The audit log: chained by hash, so a removed line shows.
Transport
Nothing travels in the clear, including inside your own network.
IP telephony long tolerated plaintext SIP on the local network. An internal network is not a trusted network: it is simply a network you have not yet seen compromised.
Signalling
SIP over TLS 1.3 exclusively. Obsolete cipher suites are refused server-side, not merely deprecated. No downgrade to plaintext SIP is possible.
Voice
SRTP with DTLS key exchange. A call whose media cannot be encrypted is not set up in the clear: it fails, and the failure is logged.
Edge to cloud
Mutual TLS: both ends present a certificate. A stolen appliance does not join your company, and a spoofed server is not accepted by your appliances.
At rest
Recordings, voicemails and transcripts encrypted on disk, with separate keys per company and a scheduled rotation.
Forty thousand euros in one night is the real cost of outbound traffic fraud on a badly configured phone system.
The spending cap is not a higher-plan option
Fraud prevention
The engine that cuts the suspicious route without cutting your company off.
The rule that matters is not detecting fraud: it is stopping it without your teams stopping work. A platform that suspends the whole account at the first anomaly has turned a fraud into an outage.
- Caps you set — simultaneous calls, calls per second, daily spend per company and per user.
- Destinations locked — international, premium rate and high-risk destinations are closed by default and opened explicitly.
- Impossible-usage detection — an extension registering from two countries in ten minutes, or calling at three in the morning a country where you have no customers.
- Surgical cut — the suspicious outbound route is closed; internal calls, the phone system and emergency calls carry on.
Threshold crossed
Extension 214 exceeds its spending cap towards a destination closed by default.
Targeted cut
That extension’s international route is closed within seconds. Its internal calls are untouched.
You are told
Immediate alert to your administrators, by email and in the console, with the detail of the calls concerned.
You decide
Reopen in one click if the activity is legitimate, or revoke the extension’s credentials if it is not.
The attack surface
The appliance in your building has no public address.
It is the question a security officer asks first, and the answer closes the subject: nothing Konvoice installs at your premises is reachable from the internet. The appliance opens the connection to the cloud, never the other way round, and there is no rule to write on your firewall.
- No inbound port — no SIP, no SSH, no administration console.
- Mutual TLS — both ends present a certificate; a stolen appliance joins nothing.
- Signed firmware — an image not signed by our build chain is refused at boot.
- Logged on the cloud side — an appliance attempting anything beyond its job is visible in your audit log.
SIP attack surface
What protects your handsets from the internet’s scanners.
A SIP port open to the internet receives its first authentication attempts within minutes. We assume the attack is permanent, because it is.
Rate limiting
By address, by account and by company. A burst of registrations is slowed before being blocked, which inconveniences the attacker without penalising a handset that is restarting.
Brute-force protection
Progressive temporary blocking after repeated failures, with trusted address lists for your sites so that a whole office is never blocked by mistake.
Anti-enumeration
Attempts to enumerate extensions receive indistinguishable answers: an attacker cannot deduce which numbers exist.
Topology hiding
None of your internal architecture appears in the SIP headers. The processing servers are never exposed directly.
Geographic restriction
Your handsets can only register from the countries where you have employees. The rest of the world is refused by default.
One secret per device
No password shared between the desk phone, the mobile and the app. Secrets are generated, never chosen, and renewable in bulk.
Identities and access
Nobody sees another company’s tenant. Ever.
Multi-tenant isolation is not a filter applied in application code: it is a constraint enforced by the database, on every query, including the ones we would write badly.
Nine roles, and yours
Super administrator, company administrator, site administrator, supervisor, agent, user, read-only, billing, support. Each adjustable, and new roles creatable per company.
Isolation enforced by the database
The separation between companies is enforced at the database row level. A query that forgot the filter returns nothing rather than returning the neighbour’s data — and our tests verify that on every release.
Strong authentication
Two-factor available everywhere and enforceable by company policy. Single sign-on over OpenID Connect or SAML with your identity provider. Sessions individually revocable.
Temporary support access
None of our engineers has permanent access to your data. Support access is requested, time-limited, traced, and visible to you in your own audit log.
Traceability
The log you will read on the day you have to prove something.
An audit log is only useful in two situations: a security incident and an inspection. In both, an incomplete or modifiable log is worth nothing.
- Every sensitive action produces an immutable, write-only event: creating an extension, assigning a number, changing routing, modifying a trunk, playing a recording, deleting a user, changing a role.
- Every event carries the author, the timestamp, the originating address and a correlation identifier linking the action to the call concerned.
- The log can be exported continuously to your own collector, so the evidence does not rest on us alone.
- Access to recordings is traced in the same way as configuration changes: knowing who listened to what is often the most important question.
Recordings
The most sensitive data we hold on your behalf.
A call recording contains a voice, a name, sometimes health data or a payment method. It is treated accordingly.
| Protection | What it means in practice |
|---|---|
| Encryption at rest | Separate keys per company, stored in a secrets manager kept apart from the file storage. |
| Access by signed link | No recording is reachable through a guessable address. Links expire within minutes and are tied to the session that requested them. |
| Playback traced | Every playback produces a named audit event, readable by your administrators. |
| Retention period you choose | Per company, per site and per queue. Deletion at expiry is automatic and effective, not merely hidden from view. |
| Deletion on request | A deleted call takes the audio, the transcript, the summary and the derived labels with it. |
| Pause during sensitive data | Recording can be suspended by the agent while a card number is entered, automatically or at the press of a button. |
| Isolation between companies | Two companies’ files share neither a logical storage space nor an encryption key. |
Our build chain
Securing the software before it reaches you.
Half of the industry’s recent security incidents come not from an attack on the platform, but from a compromised dependency or a secret left in a repository.
No secrets in the code
Repositories are scanned on every change. Secrets live in a dedicated manager, with scheduled rotation — and encrypted local storage on offline Edges.
Dependencies inventoried
A software bill of materials is produced for every release. Container images are pinned by digest and scanned before publication.
Signed releases
Every published version is signed and verified before installation, Edge appliances included. An unsigned update is not applied.
Independent review
Changes touching authentication, encryption or isolation between companies are reviewed by somebody other than their author.
Penetration tests
Carried out by a third party, across the application and telephony perimeter. The summary report is shared with customers under NDA.
A written response plan
Who decides, who calls you, within what time. Notifying a data breach in 72 hours assumes somebody knows who dials the number at three in the morning.
Responsible disclosure
Found a vulnerability? Write to us.
We do not pursue good-faith researchers and we do not ask for silence in exchange for a fix. If your report is valid, we credit you publicly — unless you would rather stay anonymous.
- Write to [email protected]. Encrypt it if you want; our key is published in the security.txt file.
- We acknowledge receipt within 48 hours and give an initial assessment within 5 working days.
- We keep you informed until the fix, and we agree the publication date with you.
- Do not access a customer’s data, do not degrade the service, and only test on the environments we open for you — that is the only condition.
What we publish
- A bulletin for every fixed vulnerability judged significant, with its severity and the versions affected.
- The state of the platform in real time, incidents in progress included.
- A written report after every major incident, including when the cause is ours.
- The named list of our sub-processors and of the regions where your data is processed.
Security questions
Are you ISO 27001 or SOC 2 certified?
Can your engineers listen to our calls?
What happens if one of your sub-processors is compromised?
How do you handle emergency calls during an incident at your end?
Do you run failure exercises?
Send us your security questionnaire.
Our answers are written, dated and signed by an identifiable person. We supply them before signing, not after.
The most common questionnaires are already filled in and available on request.