Agent-readable docs index: /docs/llms.txt. Full docs in one file: /docs/llms-full.txt. Download /docs/docs.zip to grep all markdown files locally.

Security

Ruut Voice includes fraud protection, rate limiting, and data-handling controls designed for production voice traffic.

Fraud protection

Carrier accounts can configure per-account guardrails in the dashboard (or via the carrier API):
  • Calls per minute — maximum call attempts in a rolling minute.
  • Distinct destinations per hour — limits destination fan-out to curb toll fraud.
  • Max call duration — caps how long a single call can run.
  • Destination allowlists — restrict which numbers/regions can be dialed.

Rate limits

API and call rates are enforced per account:
  • Calls Per Second (CPS) — outbound call creation is queued beyond the account's CPS.
  • Request throttles — configured per OAuth application and, for outbound call creation, per account. See rate limits for scope and configuration.
See rate limits for the full table.

Trunk security

  • Inbound traffic is rejected unless the source IP is in the trunk's inbound allowlist.
  • SIP destinations in the API are restricted to your SIP domain and an explicit allowlist — the platform can never be used to INVITE arbitrary hosts.

PII & recordings

  • Phone numbers are PII — use scoped access and follow your retention policy.
  • Recording storage and access depend on deployment configuration. Restrict access to recording URLs and apply your own retention policy.
  • Transcripts may contain sensitive personal information. Restrict access and set retention policies appropriate for your use case.
Compliance note: if your workflows involve PCI or health data, apply the appropriate safeguards on your side — Do not assume call content is automatically redacted.

Integration best practices

  • Store Auth Tokens server-side only; use scoped keys with minimal permissions.
  • Verify webhook signatures on callbacks that support them. The current call-status callback is unsigned; confirm important state through the API.
  • Set statusCallback URLs on https.
  • Rate-limit inbound webhook handlers and return 2xx quickly.
  • Set an appropriate extension TTL where needed and rotate agent credentials.

Next