Encrypted Virtual PBX

Crypto PBX.
Business conversations
protected.

Protect the transmission of voice and signaling data in your IP telephony. We will select VPN or TLS and SRTP based on your team’s devices and network.

VPN · TLS · SRTP

Crypto PBX — protection for corporate IP telephony

Privacy in Everyday Work

Discuss business.
Protect your communications.

Partner Negotiations

Deal terms, plans, and agreements deserve the same level of protection as corporate documents.

Working Outside the Office

A home network or connection while traveling for work is a good reason to check how business calls are transmitted.

Multiple Offices

When connecting a new branch, determine in advance which parts of the phone network need protection.

IP Telephony Vulnerabilities

Risks Worth Considering

IP telephony helps manage calls, connect offices, and work with reports. Voice and signaling data are transmitted over the network, so protecting them should be part of the company’s overall security system.

Call Interception

Analyzing unencrypted traffic does not require physical access to a phone line. If an attacker gains access to network traffic, they may attempt to reconstruct the contents of a conversation.

Credential Theft and Spoofing

Weak authentication and unsecured connections increase the risk of credential compromise. Unauthorized access may be used to make calls at the company’s expense or interfere with communications.

Overload and Denial of Service

A high volume of requests or short calls can overload the telephony system. Load control, filtering, and other infrastructure protection measures help reduce this risk.

Encryption helps protect transmitted data. DDoS resilience and device security require additional measures — no single protocol solves every security challenge.

Three Principles of Protection

Confidentiality.
Integrity. Availability.

Secure telephony is not only about protecting the content of conversations. It is also important to trust transmitted data and maintain service availability.

Confidentiality

Reducing the risk of unauthorized access to voice traffic and signaling information on protected segments of the connection.

Integrity

Authentication and integrity checks help detect data changes and reject unverified messages.

Availability

Network monitoring and overload protection help keep telephony services operational. The required measures depend on the architecture and service conditions.

Technology in Plain Language

Three tools.
One goal — secure communications.

The choice depends on the connection architecture. VPN and TLS/SRTP can address different needs and can be combined in a single configuration.

01 · Connection Channel

VPN Tunnel

Creates a secure channel between agreed network endpoints. Suitable for connecting an office or remote users.

Protects traffic routed through the tunnel.

02 · Signaling Data

TLS

Protects SIP message exchange between compatible nodes, including call setup and call control.

A separate mechanism is required to protect the voice stream itself.

03 · Voice Stream

SRTP

Protects the transmitted voice stream. Used together with an agreed key exchange method.

Works on segments where SRTP is configured and supported.

The boundaries of encryption depend on the entire call path. Connecting to the public telephone network does not automatically provide end-to-end encryption all the way to the other party’s phone.

Protection Method · VPN

A secure tunnel
for business telephony

A VPN creates a logical secure connection over the internet. Traffic routed through the tunnel is encrypted between its endpoints.

This can be used to connect a remote employee or office. A similar approach can be used to connect to the provider’s infrastructure when supported by the agreed architecture.

What Happens to the Data

  • Traffic is encrypted when it enters the tunnel.
  • Protected packets are transmitted over the external network.
  • At the other end of the tunnel, the data is decrypted for further processing.

Outside the VPN tunnel, protection depends on the remaining segments of the route. The tunnel itself does not make the entire conversation end-to-end encrypted.

Benefits and Limitations

When VPN Is Right for Your Team

Benefits

Secure connectivity
over the internet

  • Use the internet instead of a separate dedicated link to build the tunnel.
  • Connect remote users and link offices according to the agreed architecture.
  • Protect different types of traffic routed through the VPN.
  • Use compatible existing equipment — the need for replacement is checked during solution design.

What to Consider

Network and equipment
requirements

  • Encryption adds processing load to devices.
  • Tunneling can increase latency and the amount of transmitted data.
  • Configuration and maintenance make the network architecture more complex.
  • The number of simultaneous calls depends on equipment and link performance.

Protection Method · TLS + SRTP

Signaling data and voice:
protecting both parts of a call

Devices first exchange messages to establish the call, then transmit voice. Different security protocols are used for these two data flows.

SIP Signaling Protection

TLS

TLS provides a secure connection between compatible nodes. In IP telephony, it is used to transmit SIP messages that control call setup, modification, and termination.

  • Confidentiality of signaling exchange on the protected segment.
  • Integrity checks for transmitted messages.
  • Node authentication when certificates are configured correctly.

TLS by itself does not encrypt the voice stream.

Voice Traffic Protection

SRTP

SRTP is a secure version of the real-time media transport protocol. It is applied to the voice stream and uses keys agreed by the participants of the secure connection.

  • Media encryption when confidentiality protection is enabled.
  • Packet authentication and integrity checks.
  • Protection against replay of intercepted packets.

SRTP support and settings must be aligned on both sides of the protected segment.

What Changes with Encryption

For the employee — a conversation.
For an interceptor — protected data.

With standard RTP transmission, the voice payload is not protected by RTP encryption. With properly configured SRTP, the corresponding key is required to recover the encrypted content.

The other party hears normal voice after decryption on the receiving side. Encryption is not intended to alter the voice or create audible interference.

Quality Testing

Latency, packet loss, codecs, and equipment load affect call quality. That is why we complete the setup with testing in your network.

Configuration Selection

Protection starts
with your communication architecture

Tell us where your employees work and which phones or applications they use. During the consultation, we will determine the most suitable connection method.

What We Should Check

  • TLS and SRTP support in phones and softphones.
  • The ability to configure VPN on selected devices or the router.
  • The call path between employees, the PBX, and external numbers.
  • Internet quality and equipment load.

The result is an agreed architecture with clearly defined protection boundaries.

Crypto PBX Pricing

Add encryption
to your Virtual PBX

Virtual PBX Add-on

Crypto PBX

+25 UAH per line

For Business, Pro, and Pro Plus packages.

The billing period, connection scope, and final amount will be specified in the proposal.

What Determines the Cost

  • The selected Virtual PBX package.
  • The number of Crypto PBX lines being connected.
  • Phone numbers and calls according to your plan.

Before connection, we will agree on the encryption method, equipment compatibility, and configuration requirements.

Still choosing a telephony solution? Explore the features of Stream Telecom Virtual PBX.

Moving to Secure Communications

Connection in Three Steps

01

Discuss Your Requirements

We clarify the number of lines, workplaces, and confidentiality requirements.

02

Agree on the Configuration

We determine the appropriate protection method and the required settings for compatible devices.

03

Test the Calls

We test incoming and outgoing calls, check audio quality, and verify the selected configuration.

Let’s Start with Your Requirements

What level of protection
does your telephony need?

We will select the right Crypto PBX configuration and calculate the connection cost for your team.

Stream Telecom

+380 (44) 300 25 25

sales@streamtele.com

IP Telephony for Business →

ANSWERS BEFORE CONNECTION

Frequently Asked Questions about security, compatibility, and pricing

Crypto PBX is a Stream Telecom IP telephony security service that uses VPN and TLS/SRTP protocols. The appropriate option is selected based on your equipment and connection architecture.

VPN protects the channel between its endpoints. TLS protects SIP signaling on the configured segment, while SRTP protects the voice stream. The choice and combination of technologies depend on the communication architecture.

It depends on the model, firmware, and available connection methods. To check compatibility, prepare a list of phones, softphones, and network equipment.

Protection applies to the agreed segments of the connection. The entire conversation should not be considered end-to-end encrypted simply because TLS, SRTP, or VPN is enabled on your side. The route to the external subscriber must be considered separately.

No. Encrypting transmitted data is only one element of security. It does not replace access control, device updates, account protection, or measures against network overload.

Quality depends on the network, latency, and equipment capabilities. VPN and encryption add processing overhead, so the connection should be tested in your configuration before production use.

The published service price is an additional UAH 25 per line for the Business, Pro, and Pro Plus Virtual PBX packages. The billing period and full set of charges are confirmed when the connection is calculated.

The main changes are in the connection settings. Whether you can keep your current phones, applications, and call scenarios is checked during configuration design.