Security and compliance at the infrastructure layer
Encryption, access control, and data handling are part of the stack, not features of an app on top of it.
Encryption
At rest
AES-256 for stored data and recordings.
In transit
TLS 1.2+ for signalling and APIs, DTLS-SRTP for media.
Between modules
Self-hosted modules talk over mutual TLS.
Secrets
Named secrets sealed at rest and opened only when an agent runs.
Access and audit
Scoped tokens
API and MCP tokens carry scopes and are shown once.
Audit log
Every API and MCP action is attributed to a token, with immutable logs.
SIP traces
Every SIP message is captured for debugging and review.
Data handling
Recording control
SIPREC recordings with pause and resume for sensitive moments.
Redaction
Personal data masked in transcripts.
Erasure
A caller’s data erased across every store on request.
Your storage
Encrypted recordings on S3, GCS, or Azure, kept from 30 days to 7 years.
Telecom compliance
HIPAA
Signed BAAs for healthcare workloads.
STIR/SHAKEN
Caller ID attestation on outbound calls.
10DLC
SMS registration bundled on every plan.
E911
Emergency calling tied to registered addresses.
Questions about security?
We’ll walk your team through how DialPress handles your data.