Built to be trusted with a live platform.

• Installs for your Windows user only, in %LOCALAPPDATA%\Programs\VoIPDeck, without admin rights.
• Keeps its records in %LOCALAPPDATA%\VoIPDeck\data: change logs, copies saved before changes, reports, and the license key.
• Shows its page to your browser at 127.0.0.1 only, so nothing on the network can reach it.
• Problem reports have keys, phone numbers, email addresses, and long IDs taken out, and they go nowhere unless you send them.

• Your NetSapiens API key and Rev.io sign-in stay in memory only. They’re never written to disk or a log, and never sent back to the page.
• They’re cleared when you sign out or close VoIPDeck, or after a set time unused, if you turn that on.
• The API key goes only over HTTPS, and only to servers your license covers. The first time a computer uses a server, you confirm its name before the key is sent.
• A Reseller or Super User key reaches every tool. An Office Manager key signs in to its own domain only, and VoIPDeck keeps it there: it never asks for another domain or for system-wide records. A read-only key never sends a change.

• Only the browser VoIPDeck opened gets the page. It proves itself with a one-time secret, which is swapped for an HttpOnly, SameSite=Strict cookie.
• Every request also needs a secret that changes each time VoIPDeck starts, and has to come from VoIPDeck’s own page. Origin and Sec-Fetch-Site are both checked.
• A strict Content Security Policy allows only VoIPDeck’s own script, with no outside connections and no framing.
• Text from your phone system is always shown as text, never run.
• If something else is using VoIPDeck’s address and can’t prove it’s VoIPDeck, the window says STOP and opens nothing.

• A dial rule for one outside caller, in a domain’s own dial plan, that sends the caller to someone in that domain or hangs up
• Blocking one caller, and adding or removing whole numbers on a domain’s block list
• Removing an old hand-made block for one whole number
• Pointing an existing phone number to something in its own domain
• Adding a Basic User on a free extension (never 911, 988, 933, or other service numbers)
• Ending one live call, named by its domain, an extension on it, and its ID
• Logging one queue agent in or out

• Never deletes or changes domains, users, or dial plans
• Never touches shared or 911 rules
• Never makes managers or admins
• Never places, transfers, or answers calls

1. A preview of exactly what will change.
2. A fresh read of what’s there now. If anything differs from the preview, nothing is sent.
3. The undo record written to disk.
4. A full copy of everything it will touch, saved.
5. A log line, then one change at a time, each read back to make sure it took.

There are also limits on how much can change in any 10 minutes:

• Your license key is signed (Ed25519) and checked on your own computer. VoIPDeck never calls us to ask if it may run.
• The license names your servers, and your API key never goes to any other server.

• VoIPDeck itself is one bundle signed with our release key (Ed25519). The signature is checked against the exact bytes that run, every time it starts.
• Updates come only from voipdeck.io over HTTPS. The update list is signed, and each bundle’s SHA-256, signature, and version are checked before it’s kept.
• VoIPDeck refuses an update list that isn’t genuine, is older than the one it has, or points to another site.
• If a new version fails to start, VoIPDeck goes back to the last one by itself.
• The update check is a plain download of a public file, with no license, company, usage, or device data. You can turn it off.

VoIPDeck.exe isn’t signed with a Microsoft code-signing certificate yet, so Windows SmartScreen shows a warning the first time it runs. That’s coming.

Every version has to pass a full set of automated tests before it’s released:

• An attack test that drives VoIPDeck the way a hostile web page would, with hundreds of checks
• Page tests in a real browser, with hundreds more
• An update test that installs the real program and feeds it a good update, a broken one, and tampered ones