Security You Can Trust
Your data, your customers, and your communications deserve the highest level of protection. Here is exactly how AnrizVoIP keeps everything secure, from infrastructure to application to compliance.
Compliance & Standards We Align With
Six Layers of Protection
Security is not a single feature. It is a layered strategy applied at every level of your platform.
End-to-End Encryption
All data in transit is encrypted using TLS 1.2/1.3. Call recordings, agent data, and platform communications are secured with AES-256 encryption at rest.
Infrastructure Security
Your platform runs on your own dedicated server with no shared infrastructure. Each deployment is isolated, hardened, and configured with industry-standard security baselines.
Network Protection
Security headers (HSTS, CSP, X-Frame-Options), Cloudflare DDoS mitigation, WAF rules, and firewall configurations protect every layer of your network.
Continuous Monitoring
Real-time intrusion detection, anomaly alerts, and periodic vulnerability scans ensure threats are identified and resolved before they impact your operations.
Access Controls
Role-based access control (RBAC) with Master Admin, Tenant Admin, Manager, and Agent levels. SSH key-based server access with no shared passwords.
Incident Response
A documented incident response plan ensures rapid containment, investigation, and notification in the event of any security incident affecting your platform.
Security Headers: All Active
All six recommended HTTP security headers are deployed and active on anrizvoip.com, verified and enforced at the server level.
Forces HTTPS on every connection and eliminates protocol downgrade attacks
Prevents cross-site scripting (XSS) and data injection attacks
Blocks clickjacking by preventing your site being loaded in iframes
Stops browsers from MIME-sniffing responses away from declared content type
Controls how much referrer information is passed when navigating
Disables unused browser features like camera, microphone, and geolocation
1. Data Encryption
All data transmitted between users and AnrizVoIP servers is encrypted using TLS 1.2 and TLS 1.3, the same encryption standard used by global financial institutions. We enforce HTTPS across all pages and API endpoints with no unencrypted fallback.
- TLS 1.3 for all web traffic (strongest available)
- AES-256 encryption for data stored at rest
- Call recordings encrypted before storage
- SSL certificates auto-renewed with zero expiry risk
2. Infrastructure & Server Security
Unlike shared SaaS platforms, AnrizVoIP is deployed on your own dedicated server. Your data never shares infrastructure with other companies. Every installation follows a hardened server baseline:
- SSH key-based authentication only, with password login disabled
- Non-standard SSH port to reduce automated attack surface
- UFW/iptables firewall with only required ports open
- Fail2Ban for brute-force protection
- Regular OS and dependency security patches
- Root login disabled on all production servers
3. Network & DDoS Protection
We recommend and implement Cloudflare integration for every production deployment, providing multiple layers of network-level protection:
- Cloudflare DDoS mitigation that absorbs volumetric attacks automatically
- Web Application Firewall (WAF) that blocks OWASP Top 10 threats
- Rate limiting to prevent brute force and API abuse
- IP reputation filtering that blocks known malicious IPs
- Bot management to distinguish legitimate traffic from automated attacks
4. Application Security
The AnrizVoIP platform is built following secure coding practices and is regularly reviewed against the OWASP Top 10 vulnerabilities:
- Input validation and sanitisation on all user-facing forms
- SQL injection prevention via parameterised queries
- Cross-site scripting (XSS) protection via CSP headers and output encoding
- CSRF token enforcement on all authenticated actions
- Session management with secure, httpOnly, SameSite cookies
- Dependency vulnerability scanning on each release
5. Access Control & Authentication
The platform enforces strict role-based access control (RBAC) to ensure users can only access data and features relevant to their role:
- Master Admin: Full platform control and tenant management
- Tenant Admin: Isolated to their own tenant data only
- Manager: Campaign and agent supervision within tenant
- Agent: Call handling only, with no admin access
- Two-factor authentication (2FA) supported for admin accounts
- Automatic session timeout on inactivity
6. Compliance
AnrizVoIP is built to support compliance with major international data protection and industry-specific regulations:
- GDPR: Data subject rights, consent management, and data minimisation
- HIPAA: HIPAA-ready infrastructure for healthcare deployments with encryption, access controls, and audit logs
- PCI-DSS: No card data stored on our servers; payment processors handle card data directly
- TCPA / Do Not Call: Built-in DNC list management for outbound campaigns
- ISO 27001: Aligned information security management practices
Because the platform runs on your own server, you maintain full data sovereignty. Your data never leaves your infrastructure without your explicit action.
7. Incident Response
In the event of a security incident, AnrizVoIP follows a structured incident response process:
- Detection: Automated alerts and monitoring identify anomalies
- Containment: Immediate isolation of affected components
- Investigation: Root cause analysis with forensic review
- Notification: Affected parties notified within 72 hours as required by GDPR
- Remediation: Patches deployed and systems restored
- Review: Post-incident review to prevent recurrence
8. Responsible Disclosure
We welcome responsible disclosure of security vulnerabilities. If you have discovered a potential security issue in our platform or website, please contact us privately before making any public disclosure. We commit to:
- Acknowledging your report within 48 hours
- Keeping you informed of our investigation progress
- Resolving confirmed vulnerabilities as a priority
- Crediting researchers who report responsibly (with permission)
Please do not attempt to exploit vulnerabilities, access user data, or disrupt services during your research. We ask that you allow us reasonable time to address issues before public disclosure.
9. Contact Our Security Team
For security inquiries, vulnerability reports, or compliance questions, please reach our dedicated security team directly:
Security & Vulnerability Reports: security@anrizvoip.com
General Enquiries: Contact page
Legal & Compliance: legal@anrizvoip.com
Last updated: April 2026
Security is Built In, Not Bolted On
Every AnrizVoIP deployment ships with security hardening, encryption, and monitoring active from day one. Your platform is protected before your first call.