Security isn't a phase we get to later
Every phase of Klicko ships with tenant isolation, permission enforcement and audit logging already in place — because retrofitting security into a voice platform after the fact is how incidents happen.
Tenant isolation, enforced server-side
Every tenant-owned record is scoped at the database layer, not just filtered in application code. A request for another tenant's resource returns the same result whether that resource exists or not — no existence leaks, ever.
Permission-code authorization
Access control is a permission model (call.read, recording.delete, billing.adjust, and so on), not hard-coded role checks — enforced on every protected route on the server. The UI's permission guard is a convenience, never the actual gate.
Secrets are encrypted, never logged
Carrier credentials, API keys and webhook signing secrets are encrypted at rest with per-tenant encryption context. API keys are shown exactly once at creation and stored only as secure hashes afterward.
Non-guessable identifiers
Every resource ID is an opaque, non-sequential identifier — never an incrementing integer an attacker could enumerate.
Signed, replay-protected webhooks
Every outbound webhook is HMAC-signed with a timestamp, so a receiver can verify authenticity and reject replayed deliveries. Failed deliveries retry with backoff and a full delivery history.
Short-lived browser credentials
Browser calling never receives a permanent password. Each session gets a short-lived, single-purpose credential issued by the API, with strict origin validation on the signaling connection.
Every sensitive action, audited
Tenant creation, role changes, credential rotation, recording deletion, billing adjustments — every administrative and financial action is written to an immutable audit log, queryable per tenant.
Signaling-layer protection
The public signaling edge enforces method allow-lists, message-size limits, source-IP allow-lists, registration throttling and failed-authentication limits before a request ever reaches business logic.
Controls around the calls you connect
Klicko authorizes calls before connection using configured trunks, routes, credit limits and caller-ID rules, then records the decision path so operations teams can review what happened.
- Per-tenant route and trunk scoping
- Caller-ID presentation restricted to numbers a trunk actually owns
- Credit and concurrency checks before call connection
- Signed webhooks for downstream operational workflows
Recordings are protected as sensitive data
Recordings are spooled locally before upload, encrypted at rest, checksum-verified and accessed through permission-checked workflows. Playback and download access are audited separately from ordinary call metadata.
- Encrypted recording storage
- Checksum-verified uploads to object storage
- Permission checks before playback or download
- Recording access itself is access-audited, separate from call metadata
Security details belong in the review
Klicko already ships tenant isolation, RBAC, encrypted secrets, signed webhooks and audited operations. Additional security, compliance and governance requirements are reviewed directly with your team during production planning.
| Control | Status | Notes |
|---|---|---|
| Tenant isolation & RBAC | Live | Database and server-side enforcement |
| Encrypted secrets at rest | Live | Carrier credentials, API keys and webhook secrets |
| Signed webhooks | Live | Timestamped HMAC signatures with retry history |
| Additional governance requirements | Reviewed | Discussed during production planning |
| Deployment-specific controls | Reviewed | Matched to your environment and obligations |