Skip to content

Security

This page summarizes how QVOICE approaches security for the QVOICE Platform: independent assessment, secure software delivery, and authentication controls that customers and partners commonly ask about.

QVOICE Platform is designed for customer-hosted deployment. QVOICE develops and releases the platform software; customers (or their operators) host and operate the production infrastructure. Security responsibilities are shared: the vendor owns secure development, release integrity, and application security practice; the customer owns runtime infrastructure, network controls, backups, and operational monitoring.

Compliance programmes

QVOICE maintains programmes toward SOC 2 and ISO/IEC 27001. These programmes are in progress and are not presented here as completed certifications.

Independent Assessment (Google CASA)

QVOICE engages an independent cybersecurity firm, TAC Security, to assess application security under the Google App Defense Alliance CASA (Cloud Application Security Assessment) framework, which is built on OWASP ASVS.

Item Detail
Assessor TAC Security
Framework Google App Defense Alliance CASA (OWASP ASVS-based)
Assessed organisation 11384422 Canada Inc.
Named application AI Concierge
Assessment period 2–5 June 2026
Result ESOF Cyber Score 9.7 (Low risk)
Findings Observations classified Low / Informational; remediated (“Patched”) for CASA Tier 2 & 3

Scope: The assessment covers the platform web application (AI Concierge) and associated UC web surfaces on the same estate. It is a third-party DAST / AppSec / CASA assessment of the platform web surface — not a binary penetration test of native softphone application packages.

The full TAC Security CASA / AppSec report is available on request. Contact info@fonouc.com.

Secure Development

QVOICE operates a documented secure software development approach that includes:

  • Spec-driven design and review before implementation of non-trivial changes
  • Peer review via pull requests, with tests expected for behaviour changes
  • Multi-tenant account scoping treated as a hard security invariant
  • A Secure Coding Standard aligned with secure development expectations for customer-hosted deployments
  • Source Code Security Reviews (SCR) that combine automated static analysis (SAST), software composition analysis (SCA), and secret scanning with engineer triage against OWASP Top 10 / CWE categories

SCR reports and related evidence are available on request (typically under NDA for customer due diligence). An SCR attestation supports due diligence for source and release practice; it does not replace customer production vulnerability assessment or penetration testing of a deployed environment.

Authentication And Access

The following describes native platform authentication commonly used for portal and soft-client access. Exact tenant settings may vary by deployment; confirm with your operator where a numeric policy must be recorded.

  • Passwords — Strong passwords are required. Organisational policy for the platform vendor specifies a minimum of 12 characters for authentication to protected systems. Enforceable complexity rules for a given tenant are administered in portal / account settings.
  • Multi-factor authentication (MFA) — Supported. Email-based second-factor authentication (time-limited one-time verification code) is available. Microsoft / Google OAuth sign-in may also be configured where required.
  • Password reset — Self-service password reset via the UC portal, using the user’s registered email address.
  • Account lifecycle — Customer or partner administrators create, modify, disable, and delete users in the UC portal. Privileged / administrative roles are separate from standard end-user accounts and should follow least privilege.
  • Offboarding — When a user leaves or changes role, administrators disable or delete the account and adjust roles, devices, and queue assignments. Softphone and portal access ceases once the account can no longer authenticate or provision.
  • Credential storage — User passwords are not stored in clear text. Softphone credentials issued after authentication are delivered over TLS provisioning channels; media and signalling use TLS / SRTP where configured for the tenant.

Password expiry / history rotation and exact lockout thresholds are not published here as fixed global product defaults for all tenants. Confirm with your operator if your organisation requires specific recorded values.

Contact

For security inquiries, the full Google CASA / TAC report, SCR extracts, or other due-diligence material under NDA, contact info@fonouc.com.