Skip to main content

Security & encryption

What DialStack encrypts, where it can't, and what you control. This matters most when calls carry protected health information (PHI) or other sensitive data.

Encryption in transit​

Whether a call is encrypted depends on how it's carried:

  • Softphones (browser and mobile) are always encrypted: audio uses DTLS-SRTP and signaling uses a secure WebSocket (WSS). There is no unencrypted path.
  • Desk phones and DECT are encrypted only when the device uses the TLS SIP transport, which encrypts signaling and turns on encrypted audio (SRTP). Over UDP or TCP, signaling and audio are unencrypted. TLS is not the default today. Select it per device under Advanced (see Devices), or set sip_transport: tls in the account's or platform's device settings.
  • Voice-app audio streaming (attach) is encrypted when the URL uses wss://; a ws:// URL is not encrypted, so always use wss://.
  • Transfers and dials to a sip: address (for example an external AI voice agent) are not encrypted. Use attach instead when the audio carries PHI.
  • Calls to and from the phone network are not encrypted between DialStack and carriers, as is standard for phone calls.

Encryption at rest​

Recordings and voicemails are encrypted at rest.

Call recording and transcription are off by default for new accounts. Turn either on, or limit it to inbound, outbound or internal calls, in the account's telephony settings (see Accounts). If your jurisdiction requires every party's consent, obtain it or turn recording off. A transcript needs the call's audio, so it counts as a recording for consent purposes. Voicemail messages are always transcribed, whatever the call transcription setting.

Audit logs​

API and admin-portal actions are recorded in the account's audit log. Calls are recorded in the call log.

HIPAA and BAAs​

A business associate agreement (BAA) is available on request for platforms handling PHI. Specific compliance commitments are set in your platform agreement; reach out and we'll scope them with you.

Credentials​

How to keep API keys and tokens safe, and how to revoke them, is covered in Authentication. To report a vulnerability, see Reporting a security issue.

On this page