Your calls are encrypted. In most installations, they are not.
Everywhere we worked before, voice travelled in the clear across the company network. One device plugged into the right place could record an entire conversation, with free software, without setting off a single alarm.
For our clients, signalling and voice are encrypted from the handset to the carrier. It is on by default, for everyone, at no extra cost — not an option reserved for large accounts.
- Signalling
- SIP over TLS
- Voice
- SRTP
- Enabled
- By default, no surcharge
- Proof
- Verifiable on your network
What we find on arrival
A conversation crossing the office without an envelope.
In an ordinary phone installation, audio travels in the clear between the handset and the server. It is not a hidden defect or a vulnerability: it is the shipped default, and almost nobody changes it.
Listening in then takes no skill and no special tool. Being on the network is enough: an infected workstation, a supplier's laptop plugged into the boardroom, an old misconfigured switch, a guest Wi-Fi link that is not truly separate. This is not hacking, it is listening. And it leaves no trace.
- A credit card number read out loud at the front desk.
- A conversation about an employee, a negotiation, a client's file.
- An extension's password — enough to place calls at your expense, overnight, overseas.
- Voicemail, which takes exactly the same path.
What we turn on
Encrypted across every segment we control.
None of this is billed as an extra. It is part of the installation, for one extension as much as for two hundred.
- Encrypted signalling — SIP over TLS
- Who calls whom, the numbers dialled, the state of each extension: all of it travels encrypted. The server refuses cleartext connections rather than merely discouraging them.
- Encrypted voice — SRTP
- The audio itself. A network capture now yields an unreadable stream: there is nothing left to listen to.
- Verified certificates
- Every phone checks that it is talking to your server, not to a device that slipped in between to relay — and record — the conversation.
- Encrypted link to the carrier
- The segment between your system and the carrier is encrypted too, with the carriers that allow it. We tell you which ones do, and what it changes.
- One password per extension
- Never the factory password, never the same one everywhere. Accounts that are no longer used are removed, not disabled and forgotten.
- Automatic blocking of attempts
- Attacks on a phone system are constant and automated. Abusive sources are blocked on their own, and the blocks are visible.
- Restricted, logged administration
- Access to the configuration is limited, named and recorded: we know who changed what, and when.
- Updates actually applied
- A phone system that has not been updated in three years is an open system. Patching is part of the service, not a separate project.
What encryption does not do
So you can believe the rest.
This is not "end-to-end" in the strict sense. Your phone server has to decrypt the call in order to route it — that is true of every business phone system, ours included. What is true, and verifiable: no segment travels in the clear on your network or across the internet. Be wary of a vendor promising better than that.
Encryption does not protect against someone standing next to the phone, or the person on the other end recording their side. It does not replace passwords, updates and network separation — it is added to them.
And a call recording sitting on a disk is a different matter: there, what counts is storage encryption, access control and retention. We set those with you, but they are not the same measure.
What the law says
Law 25 never says "encryption". It demands the result.
"Any person carrying on an enterprise must take the security measures necessary to ensure the protection of the personal information […] that are reasonable given the sensitivity of the information […] and the medium on which it is stored."Act respecting the protection of personal information in the private sector, section 10
A call in which a customer gives their name, address, date of birth or card number carries personal information. Letting it travel in the clear across a network that third parties can reach is hard to defend before the Commission d'accès à l'information — especially when the measure exists, costs nothing, and amounts to a checkbox at install time.
How to check
Don't take our word for it.
This is the demonstration we run for IT teams that ask for it. It takes about fifteen minutes.
We capture your network during a test call
On your own installation, in front of you, with a tool you can install yourself.
We open the capture
If the current system is in the clear — the usual case — the conversation plays back in two clicks.
We repeat it afterwards
All that is left is an encrypted stream. Same network, same tool, same call: nothing to listen to.
A call happens once. If someone listened, you will never know.
That is what separates a conversation from a stolen file: there is no trace, no notice, nothing to restore. The only protection that counts is the one already in place before the call.
Find out where you stand.
Tell us which system you run. We will tell you whether it encrypts your calls, what would have to change, and whether it is worth the trip — sometimes the answer is no.
- telecom@opsnode.ca
- Phone
- 514 826-2207
- Form
- Write to us