Security

Encryption

• TLS 1.2/1.3 in transit (HSTS preload).
• AES-256-GCM encryption at rest for stored credentials and API keys.
• SIP TLS 5061 + SRTP for any tenant with encryptionPolicy = require_srtp_tls.
• WebRTC insertable streams enable end-to-end-encrypted video meetings when e2eeEnabled.
• Bcrypt (12 rounds) for user passwords. Sha-256 for API key hashes (raw key shown once).

Access control

• The telephony management interface is bound to loopback only; never exposed publicly.
• Internal endpoints (push forwarder, scam-shield screen, power-dialer claim) refuse non-loopback callers.
• Per-tenant ownership enforced server-side on every call-control method (channel context check before AMI action).
• SAML SSO (Okta, Azure AD, Google) for enterprise tenants.
• Two-factor authentication via SMS OTP available on every account.

Audit

All admin and security-relevant actions write a TenantActivityLog entry. Retention is 12 months.

Penetration testing

Annual external test by a CREST-certified provider. Latest summary: SOC 2-aligned controls, 0 critical findings, 2 medium findings closed, May 2026.

Vulnerability disclosure

Email info@siluxcall.co.uk, see /.well-known/security.txt. We acknowledge in 24h, triage in 5 days, and resolve in 30. Researchers acting in good faith are not pursued under the Computer Misuse Act.

Hall of Fame

Researchers who have responsibly disclosed issues are listed here once their finding is resolved.