Trusting a provider with your business communications is a big decision. This article summarizes the protections we have in place. You can see the live status of these controls any time on the Security & Compliance page in your portal.
Encryption
- In transit: all connections are encrypted with TLS 1.2 or 1.3, the standard that secures online banking.
- At rest: stored data, including recordings and files, is encrypted with AES-256.
- Cache and session data is encrypted in transit as well.
For a plain-language look at call and message encryption specifically, see How Your Calls and Messages Are Protected.
Access controls
- Role-based access: every user is an Admin, User, or Limited role, so people only see what their job requires.
- Short-lived sign-in tokens: access tokens expire quickly and refresh securely in the background, which limits the value of a stolen session.
- Account isolation: every request is scoped to your account, so one customer's data can never be reached from another's. This is enforced automatically on every query.
You extend these with your own policies, MFA, IP restrictions, and password rules, covered in Account Security Best Practices.
Audit logging
Sensitive actions are logged so there's an accurate record for security reviews:
- Call recording access is tracked by user, time, and action.
- Fax send and receive events are logged with timestamps and user context.
- API and administrative actions are recorded for review.
Canadian data residency
Your data is stored and processed in Canada, with geo-redundant backups kept in a second Canadian region for resilience. This matters for organizations with Canadian data-residency requirements.
Certifications and roadmap
We're transparent about where we are. Some programs are active today and others are in progress, and the Security & Compliance page always shows the current status. If you have specific regulatory needs, such as healthcare, see HIPAA and Healthcare Compliance for where things stand and how to reach us.
Security is a shared effort. We provide the encrypted, isolated, audited foundation; you strengthen it further with MFA, strong roles, and access policies. Start with Account Security Best Practices.