How we handleyour business phone system.
Six pillars: encryption for voicemails, transcripts, recordings and routing config; eSIM SIM-swap resistance; AWS-only US-East-1 infrastructure; configurable retention; documented incident response; US data residency. SOC 2 Type II is on the roadmap.
Encryption in transit and at rest
All connections to Kelir services use TLS 1.3 with strong ciphers. Voicemail audio, call recordings, SMS message content, and transcripts are encrypted at rest with AES-256, with keys managed by AWS KMS.
eSIM SIM-swap resistance
There's no physical card to swap. eSIM transfer requires authentication into your Kelir account; we monitor for unusual transfer patterns and require additional verification when triggered. The classic SIM-swap attack vector doesn't apply the same way.
AWS US-East-1 infrastructure
All compute, storage, and database services run in AWS us-east-1. ECS Fargate ARM64 for application services, RDS for PostgreSQL, ElastiCache for Redis, S3 for media. No multi-cloud, no third-party processors for sensitive paths.
Configurable retention
Voicemail retention defaults to 90 days (Solo) or longer per Team plan. Call recording retention is 1 year by default, configurable 30 days–7 years on Team Pro. After retention expires, files are permanently deleted.
Documented incident response
Defined incident severity tiers, on-call rotation, customer notification SLA: 24 hours for confirmed incidents affecting customer data. Status page at status.kelir.io, post-incident reports published for SEV-1 and SEV-2 events.
US-only at launch
All customer data is stored in the United States (AWS us-east-1). The product is sold only to US customers in 2026. UK launch (kelir.co.uk) follows in a later phase with appropriate data-residency controls.
Where we are,honestly.
US data subject rights honored — access, deletion, opt-out. See /legal/privacy.
On roadmap for Team Pro customers, target completion within 12 months of launch.
Built data-minimization-aware. We don't sell to EU residents at launch, so we're not a covered controller today. UK launch later.
Brand and campaign registration handled per US carrier mandate (Feb 2025). Required for business SMS.
One-business-day port-out for simple ports. Number portability is a regulated service we honor.
24-hour customer notification SLA for confirmed incidents affecting customer data. Public status page.
Found a security issue?
Email security@kelir.io with details. We acknowledge in one business day. We don't currently run a public bug bounty, but we credit responsible disclosure on this page and offer a thank-you payout in line with industry practice for valid findings.
Privacy questions or data subject requests: privacy@kelir.io. For status incidents see status.kelir.io.
Common questions
SOC 2 Type II is on the roadmap for Team Pro customers — typically completed within 12 months of launch given continuous-monitoring evidence. Pre-attestation, the security controls are aligned to SOC 2 trust principles (security, availability, confidentiality), documented in the security overview document available to Team Pro customers on request.
Kelir's recording flow is consent-aware. Each recorded call plays a configurable disclosure prompt at the start (one-party-consent states) or requires explicit caller agreement (two-party-consent states like California, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, Washington). The customer is responsible for compliance with the laws of their state and their callers' states; Kelir provides the tooling.
All Kelir customer data is stored in the United States (AWS us-east-1). Voicemails, call recordings, transcripts, and account data never leave US data centers under normal operations. We're not currently a multi-region service.
eSIM is harder to SIM-swap than physical SIM. There's no physical card to socially-engineer onto another device — eSIM transfer requires authentication into your Kelir account, which uses email + magic link or password + 2FA. The traditional SIM-swap attack vector (call center social engineering to swap a SIM card) doesn't apply the same way. We monitor account activity for suspicious patterns and require additional verification for unusual eSIM transfer requests.
Voicemails are stored 90 days by default on Solo, longer on Team plans. Call recordings (when you've enabled recording) are stored 1 year by default; Team Pro lets you configure retention from 30 days to 7 years per policy. Both retentions are user-configurable in the portal. After retention expires, files are permanently deleted.
Standard 30-day grace window after cancellation: account remains accessible for data export (call history CSV, voicemail/recording downloads). After 30 days, data is permanently deleted and the number is released for porting. Earlier deletion is available on request — email privacy@kelir.io.
Kelir is US-only at launch, so the immediate primary regulatory frame is CCPA/CPRA. We honor data subject rights — access, deletion, opt-out — and our privacy notice details what we collect and why. We're built GDPR-aware (data minimization, lawful basis, retention controls) for the UK launch later, but we're not a covered controller for EU residents today since we don't sell to them.
Email security@kelir.io with details. We acknowledge in one business day. We don't currently run a public bug bounty program, but we credit responsible disclosure on our security page and offer a thank-you payout in line with industry practice for valid findings.