Security

Ruut Voice includes fraud protection, rate limiting, and data-handling controls designed for production voice traffic.

Fraud protection

Carrier accounts can configure per-account guardrails in the dashboard (or via the carrier API):

• Calls per minute — maximum call attempts in a rolling minute.
• Distinct destinations per hour — limits destination fan-out to curb toll fraud.
• Max call duration — caps how long a single call can run.
• Destination allowlists — restrict which numbers/regions can be dialed.

Rate limits

API and call rates are enforced per account:

• Calls Per Second (CPS) — outbound call creation is queued beyond the account's CPS.
• Page limits — list endpoints cap at PageSize=1000.

See rate limits for the full table.

Trunk security

• Inbound traffic is rejected unless the source IP is in the trunk's inbound allowlist.
• SIP destinations in the API are restricted to your SIP domain and an explicit allowlist — the platform can never be used to INVITE arbitrary hosts.

PII & recordings

• Phone numbers are PII — use scoped access and follow your retention policy.
• Recordings are stored encrypted at rest and served via signed URLs.
• Transcription segments include speaker labels but no personal identifiers beyond the transcript itself.

Integration best practices

• Store Auth Tokens server-side only; use scoped keys with minimal permissions.
• Verify webhook signatures on every callback.
• Set statusCallback URLs on https.
• Rate-limit inbound webhook handlers and return 2xx quickly.
• Rotate agent credentials (they're ephemeral by default).

Next

• Errors
• Rate limits