Pre-prepared answers to common security and compliance questions from clients regarding our SIP/VoIP services.
Q: Are Mixvoip's SIP and VoIP services covered under formal security certifications?
Yes, Mixvoip's core services, including SIP and VoIP, are fully covered under our ISO/IEC 27001 certification. Mixvoip holds ISO 27001 certifications across its operations in Belgium, Germany, and Luxembourg. This international standard for information security management systems (ISMS) ensures that a systematic approach is applied to managing sensitive company information, encompassing people, processes, and IT systems through rigorous risk management.
Q: Can you confirm Mixvoip's compliance with GDPR and data protection regulations?
Mixvoip is fully compliant with both the General Data Protection Regulation (GDPR) and the EU AI Act, representing a dual compliance commitment to data protection and ethical AI usage. All calls, recordings, transcripts, AI summaries, and account data are stored and processed exclusively in Mixvoip-operated data centers located in Luxembourg. We guarantee that 100% of your data remains within the European Union. Furthermore, our AI infrastructure is proprietary and hosted internally; we do not transmit call content to external US-based AI services such as OpenAI, Google, or Anthropic.
Q: What is the security architecture overview for Mixvoip's SIP environment?
The security architecture of Mixvoip's SIP environment is built on multiple interlocking layers of defense designed to protect against evolving cyber threats. Our infrastructure is hosted in Tier IV data centers, offering redundant infrastructure and fault tolerance. At the network level, we employ managed routers (IndraSec), advanced firewall solutions from industry-leading vendors, and DNS Shield to filter malicious content. We also utilize Access Control Lists (ACLs) to restrict SIP and RTP traffic exclusively to known, trusted IP addresses, preventing unauthorized devices from reaching the phone system.
Q: How does Mixvoip handle encryption (TLS/SRTP) and credential protection?
Mixvoip enforces strict encryption protocols across all communications to ensure no plaintext data is transmitted over the network. We utilize Transport Layer Security (TLS 1.3) for web traffic and SIP over TLS to encrypt the signaling portion of VoIP calls, protecting sensitive data such as call setup, registration, and caller ID. For the audio (voice) component, we implement the Secure Real-Time Transport Protocol (SRTP), ensuring the actual conversation is encrypted and protected against eavesdropping. To protect credentials, we utilize Digest Authentication, which hashes passwords instead of sending them in plaintext, and we support Single Sign-On (SSO) via Microsoft 365 or Google Workspace for business tiers.
Q: Is Multi-Factor Authentication (MFA) supported for admin and customer portals?
Yes, Multi-Factor Authentication (MFA) is fully supported and highly recommended across Mixvoip's administrative and customer portals, including the Voxbi Cockpit. For Business plans and above, we offer Single Sign-On (SSO) integration with Microsoft 365 and Google Workspace, which allows organizations to enforce their existing MFA policies seamlessly. Furthermore, maintaining active MFA for all remote access (Cloud, VPN, On-Premise) is a mandatory requirement for clients subscribing to our CyberAssistance insurance coverage.
Q: What are Mixvoip's practices regarding access control, logging, and monitoring?
Mixvoip implements Role-Based Access Control (RBAC) at every level of the Voxbi Cockpit, ensuring users only have access to the data and features necessary for their roles. We maintain comprehensive audit logs where every administrative action is recorded with the user's identity, a timestamp, and the specific change made; these logs are exportable for your Security Operations Center (SOC). Our infrastructure is subject to 24/7 continuous monitoring covering the network, voice platform, and web surfaces, with automated paging alerting our on-call engineers within 60 seconds of any detected anomaly.