Enterprise-grade security. Built into the platform.
Acepeak security is verified annually — SOC 2 Type II, GDPR, HIPAA-aligned, PCI-DSS. Encryption everywhere, SSO out of the box, audit log streamed to your SIEM. The hard stuff, already done.
Passed
Compliance is a posture, not a checkbox. We pass the audit so you don't have to explain ours.
Audited annually.
Documented for procurement.
Every framework below is current. Reports, BAAs, DPAs and questionnaires are kept on file — your compliance team can have them within a business day.
SOC 2 Type II
Annual audit covering protection, availability, confidentiality.
GDPR
EU/EEA personal data handled per Articles 25 & 32. DPA on request.
HIPAA-aligned
BAA available. PHI stays in-region with encryption at rest.
PCI-DSS v4.0
Card data handled via tokenisation. No CHD on our systems.
POPIA
South Africa data residency. Local DPO contact provided.
STIR/SHAKEN
Caller-ID attestation A at the carrier. Spoofing blocked upstream.
The threat starts at the wire.
So does our defence.
Spoof calls, robocallers, and toll fraud get blocked before they hit your numbers — at the carrier, not at the platform. Same for emergency routing and 10DLC handling.
Tier 1 voice network
Direct interconnects with Sparkle, Lumen, Telin, T-Mobile, Airtel.
STIR/SHAKEN at carrier
Outbound attestation level A. Inbound spoof drops happen pre-platform.
E911 dynamic
Per-seat address sync. RAY BAUM's Act + Kari's Law compliant.
FCC RMD listed
Robocall Mitigation Database registered. 10DLC vetted.
Encrypted in transit.
Encrypted at rest. Isolated by tenant.
Defense in depth at every layer of the data path — from your handset to our backup vaults.
Encryption in transit
Signalling, media, and app surface — all encrypted end-to-end.
Encryption at rest
Every database, recording bucket, and backup volume is encrypted.
Tenant isolation
Logical isolation per tenant. No shared queues, recordings, or transcripts.
Backups & recovery
Daily encrypted backups. Recovery rehearsed every quarter.
SSO, RBAC, SCIM, audit log.
Your IdP is the source of truth.
Wire Acepeak to Okta, Azure AD, or Google in minutes. Provision and deprovision through SCIM. Stream every action to your SIEM via webhook or syslog.
SSO / SAML 2.0
Okta, Azure AD, Google Workspace, OneLogin. Enforce IdP-only login.
Role-based access
Granular roles for admin, supervisor, agent, billing, read-only.
Immutable audit log
Every action stamped, exportable to SIEM via webhook or syslog.
SCIM provisioning
Auto-provision and deprovision seats from your IdP. Zero stale users.
24/7 on-call. Notification within 24 hours.
A documented IR plan, tested twice a year. If something happens, your account team and DPO hear from us before you read about it.
Ready for a phone stack the auditors approve?
Questions, answered.
Acepeak runs a defense-in-depth program audited annually: SOC 2 Type II, GDPR, HIPAA-aligned, and PCI-DSS v4.0. Encryption is on by default — TLS 1.3 in transit, AES-256 at rest — and every action streams to your SIEM via webhook or syslog.
Your security, by default.
24/7 support included. Numbers ported from any carrier worldwide.