Security

RTC LEAGUE builds real-time communication infrastructure: WebRTC media pipelines, SIP trunking, and AI voice agents. That infrastructure carries live conversations for our customers and their end users, and that traffic is among the most sensitive data an organisation handles. This page describes the controls we operate to protect it, and the responsibilities that sit with you as a customer.

1. Our Approach

Security is handled as an engineering requirement rather than a compliance exercise. Controls are applied in layers, so that the failure of any single control does not by itself expose customer data:

• Encryption of data in transit and at rest;
• Least-privilege access, granted by role and reviewed on change;
• Continuous monitoring of production systems, with defined escalation paths;
• Independent third-party assessment of our controls;
• Contractual data-handling commitments, set out in the applicable Data Processing Agreement.

2. Encryption

All communications and transactions handled by the Services are encrypted to prevent unauthorised access. Real-time media transported over WebRTC is encrypted in transit using DTLS-SRTP, which is mandatory in the protocol and cannot be disabled. Application traffic, APIs, and the client portal are served over TLS.

Data at rest, including recordings, transcripts, and account data, is encrypted in our production storage. Where a deployment routes traffic through a third-party carrier or model provider, the protections applicable to that leg are governed by that provider's terms; see Section 6.

3. Access Control

Strict internal protocols ensure that only authorised personnel can handle sensitive data. Access to production systems and customer data is granted on a least-privilege basis, tied to a named individual and a documented business need, and revoked when that need ends. Administrative access is separated from day-to-day engineering access.

On your side of the boundary, the client portal enforces role-based access with the roles OWNER, ADMIN, BILLING, and MEMBER. Owners and administrators are responsible for keeping their organisation's membership list current and for removing access promptly when a person leaves.

4. Monitoring and Incident Response

Production infrastructure is monitored continuously so that potential threats and service faults are detected and acted on. Monitoring covers availability, anomalous access patterns, and system integrity.

Where an incident affects the confidentiality, integrity, or availability of customer data, we will investigate, contain, and notify affected customers in line with the notification obligations in the applicable Data Processing Agreement and the Terms of Service, and within the timeframes required by applicable law.

5. Independent Audits and Compliance

Independent third-party assessments validate our controls and inform where we strengthen them. We maintain the following positions:

• SOC 2 Type II. Our systems are independently audited against the AICPA trust services criteria: security, availability, processing integrity, confidentiality, and privacy.
• GDPR. Personal data is processed transparently, fairly, and securely, consistent with EU data protection law. Processing roles and obligations are set out in the applicable Data Processing Agreement.
• HIPAA. For customers handling protected health information, we provide HIPAA-adherent configurations and will enter into a Business Associate Agreement.

Audit reports and compliance documentation are available to customers and prospective customers under NDA. Contact us using the details in Section 8.

6. Voice, Recordings, and AI Data

Because our Services carry live calls and generate transcripts and AI-generated output, some obligations are specific to that data:

• Call recordings, transcripts, and voice data are treated as customer data and are not used for purposes inconsistent with the consent obtained from the relevant individual;
• Some AI features depend on third-party model providers. Where customer data is sent to such a provider, that transfer and its protections are described in the applicable Data Processing Agreement;
• Obtaining the consents and providing the notices required before recording, transcribing, or analysing a call is the customer's responsibility.

How personal data is collected, used, and retained is described in the Privacy Policy. Restrictions on AI use, call recording, and caller-ID integrity are set out in the Acceptable Use Policy.

7. Your Responsibilities

Security of the Services is shared. We secure the platform and the infrastructure it runs on; you are responsible for how your organisation configures and uses it. That includes:

• Safeguarding account credentials and API keys, and rotating them if you believe they have been exposed;
• Managing who holds access to your organisation in the client portal, and removing members who no longer need it;
• Obtaining the consents required by applicable law before recording, transcribing, or analysing communications;
• Using the Services within the limits of the Acceptable Use Policy.

8. Reporting a Security Issue

If you believe you have found a vulnerability in our Services, or you suspect your account has been compromised, report it to info@rtcleague.com. Please include enough detail to reproduce the issue.

We ask that you give us a reasonable opportunity to investigate and remediate before disclosing an issue publicly, and that testing does not degrade the Services or access data belonging to other customers. We do not pursue action against researchers who report in good faith and within those boundaries.

9. Related Documents

This page describes our security practices. It does not replace the commitments made in our contractual documents, which govern in the event of any conflict:

• Terms of Service is the agreement governing use of the Services.
• Privacy Policy covers how personal data is collected, used, shared, and retained.
• Acceptable Use Policy sets out prohibited and restricted uses, including AI and telephony restrictions.
• Cookie Policy covers cookies and similar technologies used on this website.