Security & Trust

We build Dialplane on the assumption that a customer login is the most sensitive thing in it. This page lists what is in place today, and we update it when that changes.

• Not saved when you sign in. The password you sign in with lives only in your encrypted session.
• Encrypted when saved. A login you save for scheduled jobs, and logins for connected systems such as SurgeMail, are stored encrypted with AES-256.
• Blanked out everywhere. Passwords and passcodes are removed from logs, responses and records. Our staff cannot read them.
• Never shown again. Once a login, user, device or SIP password is set, nothing in Dialplane shows it. A password Dialplane creates for you is shown once, when it is created.
• One exception. Custom tags on a device are shown as BroadWorks stores them, so a tag that holds a password is visible to anyone who can read that device.

• Traffic between you and Dialplane uses TLS 1.2 or higher.
• The link to your BroadWorks uses TLS 1.2 or higher by default, with the server certificate and hostname checked. You can choose an unencrypted link at signup instead.
• Saved logins are encrypted with AES-256.
• The service will not start without its encryption keys. There are no default keys.

Every request belongs to one customer, and nothing in it can read or change another customer's data.

• Each login only reaches what it can already reach in BroadWorks.
• You can narrow access further: read-only, or limited to chosen service providers or groups. Limited access cannot change account settings.
• When you connect an AI tool through our sign-in page, the tool never sees your BroadWorks password.
• AI tool sign-in uses OAuth 2.1, and the sign-in page is protected against forged requests.
• API keys can be revoked at any time.
• Sign-ins expire, and reusing an old sign-in after a few seconds ends the session.
• Refused requests are logged, so admins can see what was blocked and why.

Connected systems such as SurgeMail voicemail follow the same access rules. Their admin logins are stored encrypted, and mailbox passwords are kept out of logs and records.

• Nothing can delete a service provider, group or reseller.
• Sign-in is rate-limited per customer and per address.
• Every request is checked against the BroadWorks command format before it is sent. Raw input is never passed straight through.

Dialplane is working toward SOC 2 Type II, and the observation window is underway. Once the report is issued, customers can request it under NDA. Our controls already follow the SOC 2 criteria for security and confidentiality.

A Data Processing Addendum (DPA) is available on request:

support@dialplane.com

These vendors help us run the service. The list is current as of the date above.

If you believe you have found a security issue in Dialplane, please email us:

support@dialplane.com

• We will acknowledge receipt within three business days.
• We will not pursue legal action against good-faith researchers who follow a coordinated-disclosure process.
• We will credit reporters on request once an issue is resolved.
• Dialplane does not currently operate a paid bug bounty program.