Samyy SI processes voice and CRM data for sales operations. This page summarizes the controls applied to the platform.
Encryption
- Signalling over SIP-TLS; media over SRTP where supported by the trunk.
- TLS 1.2+ for all API and webhook traffic.
- AES-256 encryption at rest for recordings, transcripts and backups.
Access control
- Workspace-scoped API keys with rotation and revocation.
- Role-based access for console users; SSO via SAML 2.0 / OpenID Connect on Enterprise plans.
- Administrative access to production restricted to named engineers with key-based authentication.
Webhook integrity
Outgoing webhooks are signed with HMAC-SHA256 and include a timestamp to prevent replay. Deliveries are retried with exponential backoff and recorded in a delivery ledger.
Tenant isolation
Customer data is logically separated per workspace. Enterprise Node customers can deploy into a dedicated VPC.
Telephony fraud protection
Trunk registrations are restricted by IP allow-lists and geographic policies, with alerts on unusual outbound call patterns.
Data retention & archival
Retention is configurable per workspace. Enterprise customers may archive to their own S3-compatible storage.
Responsible disclosure
Report suspected vulnerabilities to founder@samyy.si. Please do not test against customer workspaces.