Security and data handling
Our software asks for real trust: AMI access to your phone system, a plugin inside your store, a loader running on your customers' servers. This page describes what the code actually does with that access — and, at the end, what we do not claim.
What a license check sends us
Licensed software that phones home deserves a straight answer about what it says. This is the whole conversation.
Darwvin Encoder sends one field
A protected build asks the license server a single question, with one parameter: a machine fingerprint (a SHA-256 hash). No domain, customer name, file path, source code or license identifier is transmitted, and the answer it reads back is one boolean.
Your key is never stored in readable form
The license server keeps only a SHA-256 hash of your key. Nobody at Darwvin can read a key back out of the database; a lost key is reissued or rotated, not recovered.
Domain binding is a comparison, not a lookup
When a license is bound to a domain, the check compares the domain you send against the bound one, ignoring a leading www., letter case and the port. A mismatch returns invalid — it does not report where else the key has been seen.
Checks are cached and survive short outages
A successful check is cached locally and the cache entry is protected against tampering. When an offline grace period is configured for your license, the software keeps running through a brief loss of connectivity instead of failing your customers.
The endpoint is rate limited
License validation is limited per IP address, so a flood of checks from one place cannot degrade validation for everyone else.
Your PBX credentials
Both telephony products need AMI or ARI access to your phone system. That is a powerful credential, so here is exactly how each product treats it.
VoIPPress encrypts them at rest
AMI secrets, ARI passwords, per-operator SIP passwords and messaging API tokens are stored encrypted with AES-256-GCM, keyed from your WordPress installation's own secret keys. The ciphertext is useless in a database copy taken without those keys.
PerfexVoIP stores them in the CRM's settings store
The module does not add its own encryption layer on top of Perfex CRM, so treat that database the way you treat any credential store: restrict access and keep backups private. We would rather tell you that than let you assume otherwise.
Secrets are write-only in the interface
Saved secrets are never rendered back into the settings page and are never sent to the browser. Leaving a secret field blank keeps the stored value instead of wiping it.
Credentials stay out of the logs
Both products log errors, not secrets. Log lines carry the failure, not the AMI password that was used.
Calling is limited to the agent making the call
Click-to-call and hangup require the right capability, and a non-administrator can only originate from an extension assigned to them and only hang up their own channel. One agent cannot dial from, or drop, another agent's line.
How your PBX talks to the plugin
Call events arrive at an endpoint your PBX can reach, which means that endpoint has to authenticate the PBX and survive being poked by anyone else.
VoIPPress signs the request body
The bridge signs each payload with HMAC-SHA256 over the exact bytes it sends; the plugin verifies that signature in constant time and refuses a shared secret shorter than 16 characters.
PerfexVoIP authenticates with a shared secret
The bridge endpoints compare a secret header in constant time and reject the shipped default value outright, so an install left on the example secret does not accept events.
Ingest is bounded
VoIPPress caps the ingest endpoint per IP address per minute, rejects bodies over 2 MiB, and limits how many events one request may carry. An optional IP allowlist narrows it to your PBX.
Recording links expire
Access to a call recording goes through a signed, time-limited URL that is verified in constant time. A link copied out of a browser history stops working.
Browser sessions are separate from machine access
The real-time push channel issues each staff member a time-limited HMAC token tied to their identity, rather than handing the browser the PBX credentials.
Call data and privacy
Call records are personal data in most of the world. VoIPPress ships the tools a controller needs to honour that.
Retention you configure and we enforce
A daily job deletes calls, call notes and events older than your retention setting, and prunes audit and automation logs on their own schedule. Set it to zero and nothing is deleted automatically — that choice is yours, not a default we make for you.
Subject access and erasure are wired into WordPress
The plugin registers a personal-data exporter and eraser, so a GDPR request made through WordPress's own tools returns that person's call records and can delete them.
Exports do not leak or attack
CSV exports require the export capability and a valid request token, mask phone numbers by default, and neutralise cells that would otherwise execute as spreadsheet formulas when opened.
Administrative actions are recorded
Exports and other administrative actions are written to an audit log with the user, the action and the client address.
How Darwvin Encoder protects your code
If you ship PHP to other people's servers, the protection has to hold on a machine you do not control.
Encrypted payload, signed manifest
Protected files carry an AES-256-GCM encrypted payload — your source, or compiled bytecode — under a manifest signed with Ed25519. Tampering with the manifest invalidates the signature; the loader will not run it.
A second envelope tied to your loader
The whole protected blob can be wrapped again with ChaCha20-Poly1305 under a per-release bind key, so a build only opens under the loader release it was produced for.
Policy is enforced when the file loads
The loader checks the signed manifest's not-before and expiry dates, machine fingerprint, domain allowlist, IP allowlist and install path before executing anything. The rules travel with the file rather than living in a config a customer can edit.
No keys ship with the tooling
Signing keys and loader bind keys are yours: none are committed to the product, and the build refuses to invent one for you.
This website and your data
What happens to what you type into this site, and to an order once you place one.
We never see a card number
No payment provider is connected yet and the platform ships no card handling at all, so there is no card data to store or leak. Purchases run through a quote and an invoice.
Forms store what you wrote, and nothing more
A contact or quote request keeps your name, email, optional company, your message and the structured answers you gave — which product, how many licenses, your platform. No tracking profile is built from it.
Your license key is not sitting in our database
We store a hash of the key, a masked form for display, and a separately encrypted copy used only to deliver it to you once. Lookups compare in constant time, and admin and customer API responses strip the key entirely.
Administrator access is hardened
Admin passwords are hashed with bcrypt, sessions use httpOnly cookies with a separate anti-forgery token compared in constant time, and the service refuses to start in production with a weak signing secret.
Public endpoints are rate limited in production
Sign-in attempts and public form submissions are limited per IP address over a rolling window, alongside standard security headers and an allowlisted cross-origin policy.
Logs redact secrets, and the database is backed up
Audit records drop any field that looks like a password, token, secret or license key before being written, and the production database is dumped daily with rotation.
What we do not claim
A security page that only lists strengths is a sales page. These are the limits, stated plainly.
- We have not had a third-party penetration test or security audit, and we hold no ISO 27001, SOC 2 or comparable certification. When that changes, it will be stated here with the date and the auditor.
- We are not a hosting provider. Your PBX, your WordPress site and your CRM stay under your control, along with their patching, backups and access rules.
- Nothing here removes your own obligations as a data controller for the call records your team collects.
Reporting a vulnerability
If you find a security problem in one of our products or in this site, tell us privately before you publish it. We will confirm we received the report, reproduce the issue and tell you when a fixed version is out. Security fixes are listed in each product's release history, so customers can see what changed and why they should update.
Please include the product, the version and the steps to reproduce. Do not test against another customer's installation.
Common questions
Does the software stop working if your license server goes down?
A successful check is cached, and licenses configured with an offline grace period keep working through a short outage. Tell us about your environment before you buy and we will tell you exactly how your build behaves without connectivity.
Can you read my call recordings or customer data?
No. The telephony products run entirely on your infrastructure — your WordPress site, your CRM, your PBX. We receive no call data, and we have no access to your systems unless you grant it for a support session.
What do you do if someone reports a vulnerability?
We confirm we received it, reproduce it, and tell you when a fixed version is available. Fixes appear in the product's release history under Security, so customers can see what changed.
Do I get the source code?
PerfexVoIP and VoIPPress are PHP that runs on your server and can be read there. Darwvin Encoder exists to protect source, so its own protected components are not readable — that is the point of the product.
Licensing terms, updates and how buying works are on the licensing page; what we store about you as a visitor is in the privacy policy.