Security & Compliance at Cannon VoIP

Your phone system carries some of the most sensitive information in your business, customer conversations, account details, sometimes protected health or financial information. Here's a straightforward rundown of what Cannon VoIP does to keep it safe, without the marketing fluff.

Encryption standards

Call setup (signaling) is encrypted using TLS, and the call audio itself is encrypted in transit using SRTP, so conversations can't be intercepted and read as they travel across the network. Data at rest, including stored recordings, voicemails, and account information, is protected with industry-standard AES-256 encryption. Encryption isn't an add-on or a premium tier here; it's simply how the system works. Saved credentials and two-factor secrets are encrypted at rest, and recordings open through short-lived private links rather than permanent URLs.

Fewer companies touching your data

Cannon VoIP is a true phone company, not a reseller. We built and run our own apps, servers, switching, portal, CRM and AI applications. For voice and texting, only three outside companies are involved: two carrier partners that connect our network to the public phone network, and the national STIR/SHAKEN authority that issues our caller ID certificates.

• Your data stays on systems we run: calls, recordings, messages and account data, so far fewer companies ever touch them.
• No reseller layer: no third-party platform vendor with its own logins and support staff.
• One team controls access: every settings change is logged, and two-step sign-in and the IP allow-list apply everywhere.
• Fewer places to leak: fewer companies means fewer places your data can be exposed or shared.

Our AI features are our own applications; today they use two outside AI providers for the language model and voices, and we are building our own AI servers to bring that in-house too. More on how it fits together on our network page.

Your data

• It stays in the United States: all customer data, including AI processing, stays in the U.S. The only exception is your own users' connections when they travel abroad. HIPAA mode lets you turn AI processing off entirely.
• It is never shared or sold: we never share or sell customer data. Ever.
• We invite outside checks: we openly take part in outside security testing and audits.

Data retention policy

You choose how long things are kept. Voicemails can be kept anywhere from 1 to 365 days, or forever. Call recordings can be kept from 1 day to 10 years, with separate retention periods for meeting recordings. When you need to preserve something for a dispute or investigation, a legal hold keeps recordings, voicemails and faxes past any retention period until you release it, and a voicemail under a legal hold cannot be deleted. Faxes are kept for a year, or seven years if you choose. You can also download everything in your account as a single file at any time.

SOC 2 & HIPAA alignment

Our internal security practices, access controls, change management, monitoring, and incident response, are built around SOC 2 principles. On the healthcare side, we maintain HIPAA-aligned safeguards for handling protected health information, which is one of the reasons medical practices and healthcare-adjacent businesses rely on us for both voice service and our HIPAA-compliant cloud fax service.

HIPAA mode

For healthcare and other businesses that handle patient information, HIPAA mode is an account-wide setting. One switch turns on every protection at once, with a switch for each protection underneath if you need to fine-tune.

• BAA on record: turning it on records that you have a signed Business Associate Agreement, with who confirmed it and when.
• No patient details in notifications: emails, alerts, and chat and text notifications on a locked phone only say something new arrived.
• Nothing sensitive sent out: webhooks, workflow webhooks and notes sent to an outside CRM leave out transcripts, summaries, recording links, message text, picture links and fax documents.
• AI processing off, if you choose: switch off transcripts, summaries, the AI receptionist, screening transcription and translation.
• Shorter keep times: recordings and voicemail are kept 90 days unless you pick another number, and clean-up also removes transcripts, call summaries, AI reviews and receptionist conversations. Legal holds still apply.
• Access log: records who opened or played each recording, voicemail, fax, transcript or summary.
• Tighter sign-in: two-step sign-in for everyone, and the portal signs people out after 15 minutes without use.

Sign-in security and MFA

Two-factor sign-in works with an authenticator app or emailed codes, and admins can require two-factor for everyone on the account without locking anyone out. Two-step sign-in still applies after you continue with Google or Microsoft. A password alone isn't enough protection for a system tied to your phone lines, billing and call data, so we strongly recommend turning it on.

• IP allow-list: lock sign-in to your office networks, with a warning before you lock yourself out.
• New-device emails: you get an email when a new device signs in, with its approximate location.
• Session list: see everywhere you are signed in and sign out everywhere else with one button. Changing your password also signs out your other devices, and changing someone’s sign-in email signs them out everywhere and tells the old address.
• Lockouts: repeated wrong passwords lock the account, with an email explaining how to get back in.
• Support code: a rotating six-digit code proves who you are when you call support.
• Audit log: every settings change is logged with who made it, when, and the before and after values.
• API keys: keys expire after a year by default, or up to two years if you choose, and can never manage users, sign port papers or touch billing.
• Live Help: lets support see your portal screen. Helpers can point but never click, password fields are masked, only one helper can join at a time, and every session is logged.

Fraud prevention

A few of the ways we help keep fraudulent activity off your lines:

• Caller verification and screening: callers the network has flagged can be asked four spoken questions (name, company, reason, and how they got your number), and their answers show on screen when your phone rings. Call screening lets any caller state their name and reason before you decide to answer.
• Human-reviewed spam listings: numbers reported by several unrelated customers are reviewed by a person, and every network-wide listing is decided by a person with a written reason. Blocked callers can appeal.
• Toll-fraud monitoring: international spending is watched around the clock, the costliest destinations stay blocked until agreed, and international calling can be switched off entirely. Transfers and call flips to outside numbers follow the same international and suspension rules as a dialed call.
• Toll-free protection: toll-free numbers turn away calls from outside the US unless you allow them, number by number.
• Dial-in protection: unusual dial-in calling is flagged as a possible leaked PIN.
• Network edge protection: password-guessing and scanning are blocked automatically, and offices that sign in successfully are never blocked by mistake.
• Block lists: block specific numbers just for you or for the whole company, right from your account, or dial *97 to block your last caller.

Call recording compliance

Recording is a company setting you choose: all calls, inbound only, outbound only, or none. You can override it per phone number or per extension, and "off" on an extension always wins. Consent laws for recording vary by state, and the "this call may be recorded" notice follows state consent laws automatically. Recorded calls can be transcribed and summarized, and in the apps you can pause recording while a card number is read out.

STIR/SHAKEN implementation

Every call that leaves our network is signed with STIR/SHAKEN caller ID authentication, the framework mandated by the FCC to fight illegal robocalls and spoofed caller ID. Calls get the highest trust rating (full attestation) when the number truly belongs to the caller, and every caller ID is checked against numbers you actually own. In plain terms, it means the people and businesses you call can trust that the number showing up on their screen is genuinely yours, which helps your calls get answered instead of flagged as "Spam Likely" by carriers and call-blocking apps.

911 and emergency calling

A 911 address is registered on each phone number and checked with 911 systems before it is registered. Each building can be a 911 site with its own address, desk phones send their building’s address, and an extension at another site can be given its own 911 number. The Numbers screen shows each 911 address and whether the carrier has it ready. 911 calls from the mobile app send the phone’s location, or the account address when there is no location fix, and the apps show the address and callback number a 911 call would send right now. 911 works with or without a 9 first, gets past Do Not Disturb and billing holds, and a 911 caller hears ringing at once, even when the system is busy. If a 911 call cannot be placed, it is tried again, and then the caller is told to hang up and redial.

You choose who is alerted when anyone dials 911, including outside contacts like an alarm company, by portal notice, email, text and phone call, with a follow-up once the call ends. Dial 933 to test. For 30 minutes after a 911 call, no incoming call is filtered or blocked, so dispatch can always call back.

Robocall Mitigation Database & Do-Not-Originate

Beyond STIR/SHAKEN, the FCC requires every voice service provider to certify its anti-robocall practices in the Robocall Mitigation Database (RMD). We're filed and current in the database, and any carrier we work with is required to confirm that filing before carrying our traffic, so there's no gap in the chain of accountability.

We also honor Do-Not-Originate (DNO) lists, numbers used only to receive calls, like certain government agency and financial institution lines, that should never appear as an outbound caller ID. Any call attempting to spoof a DNO-listed number is blocked before it ever reaches its destination.

On top of these, we participate in the industry programs every compliant U.S. voice provider is required to: cooperating with the USTelecom Industry Traceback Group on illegal call investigations, maintaining our FCC registration (FRN) and Universal Service Fund contributions, and adhering to the National Do Not Call Registry. None of this is optional for a legitimate carrier, and we treat it as table stakes, not a bragging point.

Related reading: our plain-English guide to E911 rules (Kari's Law and RAY BAUM'S Act).