VoIP security is the set of controls that protect business calls in transit and at rest — encrypting signaling and media, authenticating every endpoint, verifying caller identity, and limiting what an attacker can do if a credential leaks.
Voice traffic crosses the public internet, so it needs the same treatment as any other sensitive data path. Below is exactly what Salamtalk does, and what you remain responsible for.
How is voice traffic encrypted?
Both layers are encrypted independently. Call setup and control messages run over TLS 1.3, and the audio itself is protected with SRTP. Encrypting only one layer is a common mistake: TLS alone leaves the media stream readable, and SRTP alone leaves call metadata — who called whom, when, for how long — exposed.
Unencrypted SIP on a public network can be captured and reassembled into audio with freely available tools. That is why encryption is on by default rather than an upgrade.
What compliance standards does Salamtalk meet?
Salamtalk is SOC 2 Type II audited, covering security, availability and confidentiality controls. The platform is aligned with HIPAA for healthcare communications and GDPR for handling personal data of EU residents, and it supports STIR/SHAKEN caller authentication as required of US carriers.
A note on scope: a compliant platform is necessary but not sufficient. HIPAA compliance, for example, also depends on how your organization configures access, retention and workforce training. We supply the controls and documentation; the obligations remain yours.
How does Salamtalk prevent toll fraud?
Toll fraud happens when an attacker gets valid SIP credentials and dials expensive international or premium-rate destinations, usually overnight or over a weekend so the traffic runs for hours before anyone notices. Charges accumulate at carrier rates and are typically not reversible.
The defenses that matter are layered:
- Per-extension credentials — never one shared secret across a site.
- Destination allowlisting — most businesses never legitimately dial most countries.
- Rate limiting and concurrent-call caps so a compromised extension cannot open hundreds of channels.
- Anomaly alerting on unusual volume, destinations or time-of-day patterns.
What happens if a data center goes down?
Calls route to another region. The platform runs with geo-redundant failover behind a 99.9% uptime SLA, so the loss of a single location degrades capacity rather than ending service.
We publish 99.9% rather than a higher figure because it is the number we are prepared to stand behind contractually. Treat any provider's uptime claim as a question about the SLA document, not the marketing page.
Who can access call recordings?
Access is role-based and logged. Recordings are encrypted at rest and in transit, playback is restricted to the roles you designate, and retention windows are configurable to match your regulatory obligations.
Before enabling recording, confirm your consent requirements. Several US states require all-party consent, and rules differ again across the EU — this is a legal determination for your organization, not a platform setting.
Frequently asked questions
Is VoIP secure enough for healthcare or financial data?
Yes, when configured correctly. Salamtalk is SOC 2 Type II audited with TLS 1.3 signaling and SRTP media encryption, and is aligned with HIPAA and GDPR. Your organization remains responsible for access control, retention policy and staff training.
Does encryption affect call quality?
No measurable effect. Salamtalk uses the Opus codec at roughly 50 kbps per concurrent call with sub-15ms latency, and encryption overhead is negligible at that bitrate.
What is STIR/SHAKEN and do I need it?
STIR/SHAKEN cryptographically attests that a caller is entitled to use the number shown on caller ID. It is required of US carriers and reduces the chance that your legitimate outbound calls are flagged as spam.
Can we get a copy of your SOC 2 report?
Yes. Contact our team and we will provide the current SOC 2 Type II report and complete security questionnaires under NDA.
How do you protect against toll fraud?
Per-extension credentials, destination allowlisting, concurrent-call caps, rate limiting, and anomaly alerting on unusual volume or destinations. These limit the exposure window if a credential is ever compromised.
