Security
at DialPhone.

Phone systems sit at an awkward intersection of security threat models. They handle PSTN traffic, which still carries unauthenticated caller-ID flows and decades-old protocol assumptions, while also handling sensitive customer conversations that often include payment-card data, protected health information, and brokered financial communications. A defense-in-depth strategy that works for a web SaaS does not automatically work for a phone platform — voice paths, SMS gateways, and recording archives each have their own threat profile.

The seven layers below describe how DialPhone addresses each surface independently. Perimeter handles PSTN-level abuse: STIR/SHAKEN attestation outbound (so customer calls register as verified), carrier-grade filtering of inbound robocall floods, and DDoS protection on the HTTP and SIP control planes. Identity defaults to SAML SSO with enforced MFA for both staff and customer admins; no shared passwords, no on-by-default API keys. Data uses AES-256-GCM at rest with hardware-backed KMS, tenant-key isolation for enterprise customers, and PHI tokenization before any AI inference call. Detection and Response run 24/7 with a 72-hour breach notification commitment in the customer contract — not a marketing target.

For technical buyers running a security review, the documentation under the Trust Center covers SOC 2 Type II report request, penetration-test summaries, coordinated disclosure program, and the full subprocessor registry. For data-handling specifics, see the privacy commitments page. To report a security issue, email [email protected] — acknowledgement within 24 hours.