Telephony · In development

Our own phone system– in development

SecTepe.Comm is getting its own phone system. The core is built and tested. So is a service that links calls to your apps. Neither is rolled out yet. You cannot make calls with it today. Extensions, phone lines (trunks), queues and voicemail are still missing.

Built so far

Phone system core, built from source
Control interface reachable only on the server itself
TLS and SRTP for desk phones
Click-to-dial
Caller pop-up for incoming calls (screen pop)
Call log with a tenant field

What comes next

These parts are in the plan. None of them is built yet. We give no dates.

SIP trunks (planned)

Phone lines (trunks) will be set up as code. The plan expects only a few, and they rarely change. Unencrypted SIP is used only where a provider offers nothing else.

Voice menus (planned)

Voice menus ("Press 1 for sales") will live in the call plan as code. Where it pays off, the integration service will run them through the control interface.

Queues and ring groups (planned)

Queues will be defined as code. While calls run, the service controls them through the control interface.

Call recording (off by default)

Recording will use what the phone system has on board. It stays off by default. Where you turn it on, the design calls for an announcement and a retention period.

Voicemail (planned)

Voicemail will use the phone system's own tools. Notices of new messages will go out by email through the existing gateway. You will find voicemail and the call list in the web interface.

Extension management (planned)

A new tool will create and change extensions and trunks. It takes over the job of the screens in the old admin interface. It is the largest open task.

Technology & status

The old admin interface has been removed from SecTepe.Comm. It never went live. Its base image had also vanished from the public registry. The new setup runs the phone system directly, next to our own integration service.

• Phone system pinned to one fixed source version
• Slim Debian base (trixie-slim), pinned by checksum
• Signed image with proof of origin (SLSA) and a vulnerability scan
• SIP through the current driver only; the old one stays off
• Voice codecs: G.722, A-law, μ-law
• TLS 1.2 or newer for SIP over TLS

Status today

The automated build pipeline builds the phone system and runs a start-up test
The integration service builds; its logic is tested
The web interface can show the screen pop window
Not yet in any install template, including Kubernetes

How telephony works in practice

SecTepe.Comm runs its own phone system. A separate integration service links calls to your other apps. Both parts are built and tested. They are not yet part of the standard install templates, including Kubernetes.

How the parts fit together

The phone system handles SIP and voice. We build it from source code. The version is fixed, and it runs on a slim Debian base.
The call plan hands every call to the integration service through the control interface of the phone system. The service then decides what happens next.
The control interface listens only on the server itself (loopback). It is never reachable from outside.
Desk phones use SIP over TLS on port 5061 with encrypted voice (SRTP). Unencrypted SIP on UDP 5060 is only for phone lines that need it and for devices in your own network.

What the integration service does

Click-to-dial: You click a number in the web interface. Your own phone rings first, then the other party.
Screen pop: On an incoming call, a small window shows the caller's number and, if known, the name. It goes only to the person whose phone rings. If an extension has no owner, no window appears.
Call log: The service keeps a call journal. Each entry has a tenant field. The phone system will pass the tenant in a later stage.
On-call alerts: It can phone the on-call team when an alert fires. This is off by default. It only dials numbers on an approved list.

Security by design

The phone system loads only the modules named in its config. Everything else stays off, including the old SIP driver. There is no anonymous endpoint. Unknown calls are hung up, not routed onward. Together this blocks the classic toll fraud pattern. The image holds no secrets. It will not start without a control interface password of at least 20 characters.

Technical foundation

SecTepe.Comm uses proven open-source building blocks: Asterisk 22 (version 22.11.0) as the phone system, controlled through its REST interface ARI. The former FreePBX interface has been removed.

Common questions

Can I make calls with it today? No. Nothing is rolled out, and there are no extensions or trunks yet.

Is call recording on? Not by default. In Germany, recording needs consent from both sides. Where you turn it on, the design calls for an announcement and a retention period.

What about extensions, queues and voicemail? They are the next steps of the rebuild. Extensions and phone lines will come from a new extension management tool. Until then, the system accepts no calls, because no one is registered.

Why was the old admin interface dropped? It was only a web interface on top of the phone system. The interfaces for linking apps belong to the phone system itself. Dropping it removes a whole layer of extra software.

Is high availability planned? Not in this plan. It would need a plan of its own.

Interested in our own phone system?

Telephony is not available yet. Tell us what you need. We will walk you through the plan and the current status.

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.

Common questions

We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.

How do we start working with SecTepe?: Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
What company sizes and sectors do you support?: We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
Do you work on site, remotely or hybrid?: Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
Which standards and regulations do you cover?: We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
How do you protect the confidentiality of my data?: By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.

Book a conversation