Three ways to connect. You pick the one your security posture requires.
Public-internet SIP with TLS+SRTP, IPsec VPN to our SBCs, or private IP NNI at a carrier-neutral facility. Same per-minute rates, same DID prices — the interconnect method doesn't affect pricing.
TLS + SRTP over public internet
SIP signaling over TLS, media over SRTP. Your SBC or softswitch authenticates with a certificate, and every packet between you and us is encrypted. No tunnel, no dedicated circuit — it works from any location with decent internet. This is the right default for most customers who want encryption without re-architecting their network. Provisioning is same-day: you generate a CSR, we sign it (or you bring a public CA cert), and we whitelist your source IPs.
Technical detailsexpand ↓
TLS 1.2+ on SIP/TLS port 5061 (TLS 1.3 preferred, both supported). Media encrypted with SRTP AES-128 and HMAC-SHA1 auth. Customer authenticates with an X.509 cert (public CA or we issue one). SRTP keys negotiated via SDES in SDP, or DTLS-SRTP on request. IP allowlist optional on top of cert auth.
IPsec VPN to our SBCs
A site-to-site tunnel from your edge device to our SBC cluster. Everything inside — SIP signaling, RTP media, registration traffic — travels inside the encrypted tunnel, so your internal systems don't need TLS or SRTP support. Useful when you want full-tunnel privacy but don't want to manage certificates at the SIP layer, or when your PBX has patchy TLS/SRTP support. Works well for organizations that already run IPsec site-to-site for other services and want SIP to sit inside the same encrypted fabric.
Technical detailsexpand ↓
IKEv2 with pre-shared key or X.509 certificate auth. AES-256-GCM and SHA-256 by default; other ciphers negotiable. Active-active tunnels to our US East and US West SBCs for failover. SIP runs in the clear inside the tunnel, which keeps your PBX config simple.
Private IP NNI
A dedicated layer-2 or layer-3 interconnect — no public internet in the path at all. Common for banks, government contractors, and large enterprises with compliance requirements that rule out internet-based connections entirely. We peer with you at a carrier-neutral facility or over a private circuit you bring to us. Higher commercial minimum applies. Lead time is longer than the other methods because cross-connect provisioning depends on the facility.
Technical detailsexpand ↓
BGP over a dedicated cross-connect at Equinix Ashburn (DC1–DC11), NY4/NY5, or LD6 — other facilities on request. /30 peering, typically a 1G or 10G port. MPLS L3VPN acceptable if you bring the service. Lead time 10–20 business days depending on facility; other methods provision within 24 hours.
Not sure which method fits?
Send us your security requirements and we'll tell you what we'd pick — and what other customers at your scale chose.