The architecture, published.
No form, no badge wall.
We don't pretend to audit the server you run. We publish how the system works, what is encrypted and where, and what we can and cannot see. All of it on this page, with no form in front of it — the way an auditor would want it.
Self-hosted: it runs inside the environment you already operate.
With self-hosting, call audio, recordings and call records stay on your server, so processing stays in the environment you already run. Hosted by us is different: Saj Serve operates that deployment. Account for that hosted service in your own data-processing review.
What is encrypted, and where.
Browser and mobile calls are encrypted between the app and your server, with per-call keys that are never stored.
The admin console and everything between our own components runs encrypted in transit, with post-quantum-ready key exchange on the internal audio path.
Desk phones on your LAN carry audio on your own network, the same as every on-premise phone system ever sold. In a self-hosted deployment that traffic never touches the internet, and it can be encrypted end to end on request.
If a desk phone registers across the public internet, put it on your VPN or use the encrypted mobile and desktop apps. We say so in the docs, plainly.
Phones authenticate with the standard method every desk phone already speaks, and outbound calls carry a signed caller identity (STIR/SHAKEN) on carriers that support it.
The complete outbound inventory.
Here is every outbound connection the system makes. That is the full list.
This is a topology you can check, not a policy you have to trust. Inspect the outbound traffic on the box and confirm the list yourself.
Who holds which keys.
What we do on our side.
This page provides the architecture, encryption details and outbound connection inventory. A hosted-service assurance report is not on this page.
Found something?
Report vulnerabilities to [email protected]. A human engineer reads that inbox. We acknowledge within two business days, keep you informed, and credit you if you want credit.
Please don't test against systems you don't own. That's what the free self-hosted tier is for.