Security Practices

Defined Terms

Application within Security Practices. “ARCAMUSA,” “we,” “us,” and “our” mean Arcamusa, Inc., operator of ARCAMUSA Wholesale. “Customer” means the business entity authorized to use the Wholesale Services. “Traffic” means calls, signaling, metadata and related activity submitted to or received from the Wholesale Services. “Caller ID” or “CLI” means calling-party identification information. “Downstream Customer” and “End User” mean persons or entities using services through Customer.

Application within Security Practices. “Agreement” includes applicable online terms and policies together with any signed MSA, Order Form or Rate Sheet. “CDR” means a call detail record used for operational, billing, reconciliation, security or compliance purposes. Defined terms apply consistently across the Legal & Trust Center unless a document expressly provides a narrower meaning.

Access & Credentials

Administrative and Customer access should be restricted according to role and need. Credentials must be protected, unique where feasible and promptly changed when compromise is suspected.

Operational Protection

ARCAMUSA may apply logging, monitoring, validation, rate or concurrency controls and incident review appropriate to service risk without disclosing exploitable thresholds or architecture.

Backups and recovery measures are selected according to service and data criticality, protected from unauthorized access and periodically evaluated for restoration readiness. Public disclosure does not identify backup locations, schedules or architecture that could weaken those controls.

Shared Responsibility

Customer must secure its systems, SIP equipment, networks, credentials and authorized users; maintain updates; restrict source access; and promptly report suspected compromise.

Data & Incident Principles

Information access should be limited and suspected incidents assessed, contained and handled under applicable law and agreements. No claim of SOC 2, ISO 27001, PCI DSS, HIPAA, complete security or invulnerability is made.

Confidential Infrastructure

Provider names, internal addressing, topology, systems, credentials, balances, database information and exact fraud rules are confidential and are not disclosed publicly.

Security Governance

Security responsibilities are assigned according to business and technical roles, and controls are reviewed in light of service scope and risk.

Material production changes follow documented change control appropriate to risk, including authorization, testing or validation, implementation accountability and a recovery path. Emergency changes may use an expedited process but remain subject to later review.

Access Control

Access should follow least-privilege principles, approved authorization and timely removal when roles change. Customers remain responsible for their own users.

Administrative access is assigned on a least-privilege basis according to job function, reviewed when responsibilities change and removed when no longer required. Privileged actions may be subject to additional authentication, approval and logging appropriate to the system involved.

Authentication and Secrets

Credentials, keys and tokens must be protected, transmitted through approved channels and rotated or revoked when compromise is suspected.

Network and Application Protection

Layered controls may include segmentation, filtering, patching, secure configuration, logging and monitoring appropriate to the system.

Logging and Monitoring

Operational and security events may be logged to investigate anomalies, support service and protect networks, subject to access and retention controls.

Vulnerability Handling

Credible vulnerability reports are triaged according to affected systems, severity and available evidence. Public forms must not contain exploit code or sensitive customer data.

Incident Response

Potential incidents are assessed, contained, remediated and documented, with notices made according to applicable law and contractual duties.

Vendor Risk

Service providers are evaluated according to function and risk and are subject to appropriate contractual or security expectations.

Customer Responsibilities

Customers must secure PBX, SBC, endpoints, networks and administrators; restrict access; monitor usage; and promptly report suspicious activity.

No Absolute Guarantee

Public security descriptions state principles rather than certifying that every threat can be prevented or promising an unverified standard.

Contract Hierarchy & Related Documents

These public practices describe security principles without exposing architecture or exploitable configurations. Customer contractual security commitments, if any, appear in the applicable signed agreement or data processing addendum; Acceptable Use separately prohibits attacks and credential misuse.

The incident provisions here coordinate with Privacy, CPNI and Data Processing according to the affected information and ARCAMUSA’s role. A public description of a control is not a guarantee that every service uses identical implementation or that risk can be eliminated.