Security & compliance, built into every layer
Telecom fraud and account takeover cost operators millions. Vexyron Switch is engineered to keep attackers out of your switch, your billing and your customers' accounts.
Protection from the SIP edge to the ledger
Every request is checked, every secret is encrypted and every change is recorded — without slowing down your calls.
SIP protection
Flood, brute-force and scanner bans with topology hiding.
Two-factor everywhere
2FA for all roles, enforced for staff and resellers.
Encrypted secrets
AES-256-GCM at rest, rotating tokens with reuse detection.
Immutable audit
Every change and sign-in recorded with IP and location.
What's protecting your platform
SIP & call security
Stops attacks before they reach your routes.
- Flood protection and brute-force bans per IP and per username
- Scanner detection and automatic bans
- In-dialog protection — forged requests rejected
- Nonce protection for digest authentication
- WebRTC protection keyed by the real client IP
- Topology hiding towards customers and vendors
- Do-Not-Originate list and number-reputation checks
- Channel, CPS and duration limits at every level
Account & access
Only the right people, with the right permissions.
- Two-factor authentication with QR enrolment for every role
- Owner policy requiring 2FA for staff and resellers (on by default)
- 57 permissions, 12 system roles and custom roles
- No privilege escalation — users can only grant what they hold
- Active sessions with device, IP and location; sign out everywhere
- Login backoff per account + IP and MFA failure lock
- Secure password reset — single-use links, no account enumeration
- API keys with narrowed permissions, IP allowlists and rate limits
Data protection
Your data and your customers' data, isolated and encrypted.
- Modern password hashing (Argon2id)
- Encrypted secrets at rest with AES-256-GCM
- Signed access tokens with rotating refresh tokens and reuse detection
- HttpOnly / SameSite cookies and CSRF protection
- Strict, nonce-based Content Security Policy
- Tenant isolation enforced in every query
- SSRF protection for webhooks and external services
- CSV exports protected against formula injection
Infrastructure hardening
Locked-down hosting, managed by our team.
- Hardened containers: non-root, read-only, dropped capabilities
- Host firewall configuration
- Least-privilege database access
- Management interfaces disabled by default
- Automatic TLS certificates
- Backups without secrets, with optional encryption
Catch fraud in real time — automatically
Configurable fraud profiles watch your traffic around the clock and act the moment something looks wrong.
Fraud rules
High cost, velocity, CPS spike, concurrent calls, long duration, short calls, ASR drop and balance depletion.
Automatic actions
Log, alert, block or suspend — with events that your team can acknowledge, plus IP and country blocks.
Transcript scanning
Speech-to-text transcripts scanned for scam and fraud phrases to flag, alert or suspend.
STIR/SHAKEN
Signing with A/B/C attestation, inbound verification with verstat and certificate management.
Compliance records
Store RMD, FCC 499 Filer ID, OCN, FRN, EIN and more on each client profile.
Full audit trail
Immutable audit log of every change and sign-in with IP geolocation, device and time.
Launch your softswitch with Vexyron Labs
Tell us about your traffic and we will come back with a tailored setup plan and quote — usually within one business day.