product — the mechanism, in depth

Voice infrastructure that behaves like software.

VoipFlow is multi-tenant cloud infrastructure orchestration software. Four mechanisms do almost all of the work — tenant partitions, zero-touch certificates, port 5062, and an edge close to your users.

mechanism 1

Tenant partitions

Every client of yours is an isolated tenant partition — configuration, certificates, ACLs, and dashboards — unlimited partitions on every plan. Your L2 technicians are productive in about 15 minutes; there is no SIP-specialist dependency.

Portal, invoices, and dashboards carry your brand. Your client never learns our name.

tenant partitions — isolated by construction

$ voipflow tenant ls --brand acme-msp

acme-msp │ 14 partitions │ 50 CC cap │ cert: OK

├── client-a.example [OK] tls1.3 5062

├── client-b.example [OK] tls1.3 5062

└── client-c.example [OK] tls1.3 5062

isolation: config / cert / acl / media — per partition

mechanism 2

Zero-touch certificates

Let's Encrypt wildcard certificates issue, renew, and bind themselves natively — no scripts, no calendar reminders, no CLI babysitting. Issue-to-bind takes about 12 seconds, per tenant, across all tenant SIP domains.

The 90-day renewal trap is a process problem, so the fix is a process: the certificate lifecycle is closed inside the orchestration layer.

acme lifecycle — tenant client-a.example

00.0s order: wildcard *.client-a.example

03.1s challenge: dns-01 ... verified

07.4s issued: fullchain 2048-bit ECDSA

11.8s bound: SIP TLS listener reloaded — zero dropped calls

next: day 60, automatic — no human in the loop

mechanism 3

Port 5062: the SIP ALG bypass

Residential routers ship with stateful SIP ALG inspection enabled on 5060/5061 — it rewrites Via and Contact headers and corrupts the ACK. Under RFC 3261, Timer H expires exactly 32 seconds (64×T1) after the 200 OK, the SBC sends BYE, and the call drops. Every time.

VoipFlow's signaling listens on port 5062. Residential ALG rewriting applies to 5060/5061, so the signaling passes untouched. It's not clever — it's the boring fix that works on every home router we've tested.

Media fallback: for the stubborn few, proxy-media is budgeted at 20% of traffic — stated plainly, because you plan capacity with real numbers.

ladder — ALG rewriting on 5060 (the 32s drop)

ladder — port 5062 bypass (clean)

Before/after trace pair: on port 5060 the ISP router's SIP ALG rewrites Via and Contact headers and the call fails at exactly 32.0 seconds with Timer H expired; on port 5062 the signaling bypasses the ALG and the handshake completes OK. — :5060 through the ALG — rewrites, retransmits, Timer H dead at 32.0 s. :5062 bypass — handshake intact, call clean.

the console your technicians get

Dark, sparse, calm. No CLI babysitting.

VoipFlow tenant console UI: tenant partitions with concurrent-session counts and status, one honest amber WARN state in the table. — Tenant partitions — status per client, under your brand.

VoipFlow ACME certificates screen: per-domain Let's Encrypt certificates with issue times around 12 seconds and automatic renewals, all rows resolving to green OK. — ACME automation — issue-and-bind in ~12 s, renewal scheduled in 60 days, zero touch.

mechanism 4

Five edge nodes

Atlanta, Silicon Valley, Frankfurt, London, Sydney. Signaling lands close to the user; media stays short. Latency per region is on the dashboard, not in a slide deck.

Compliance and security, factually: TLS 1.2+ and SRTP everywhere, EU data pinning for EU-tenant workloads, IP ACLs and toll-fraud controls per tenant, Kari's Law notifications and RAY BAUM'S PIDF-LO pass-through supported — emergency call delivery stays with your carrier. Trust page.

edge — 5 geographies5 NODES OK

see it on your own tenants

Deploy Free 14-Day Sandbox — No Credit Card Required

14 days. No credit card. No sales follow-up unless you ask.