You are typing
a card into a site
you found
ten minutes ago.

What we do not have yet

Starting here, because it is the question a careful reader asks first and burying it would be its own answer. Kliwe does not hold SOC 2 and does not hold ISO 27001. We are a young company, those audits take time and money we are currently spending on the product, and we are not going to put a badge on this page implying otherwise.

What we will do is answer a security questionnaire in writing, in the same detail as everything below, and say “not yet” plainly where that is the answer. If a certification is a hard requirement for you today, we would rather you knew now than after topping up.

What happens to the call

• The browser leg is encrypted. Audio between your browser and Kliwe uses DTLS-SRTP, the same encryption every browser uses for voice and video. Signalling runs over TLS.
• The rest of the journey is the telephone network, and nobody can encrypt that. Once your call leaves us for the carrier that will ring the number you dialled, it is an ordinary phone call on the public network. No provider on earth encrypts that leg, and any service implying it does is telling you something that is not true. We would rather be the ones who say so.
• Calls are never recorded. There is no audio anywhere in this product — no recording is requested, fetched or stored — so there is no archive of your voice to leak, subpoena or misconfigure. An account can switch on written transcripts, which are text, cost money and are deleted on a fixed schedule. The sound itself is not kept either way.
• Emergency calls do not work. Kliwe cannot reach 911, 112, 999 or any national emergency number, because we cannot establish where you physically are. Keep another way to call for help. This is stated here as well as on the home page because it is a safety matter, not a feature gap.

What happens to your card

• We never see it. Payments run through Stripe. Card details are entered on Stripe’s side and do not reach our servers at any point, so there is no card number in our systems to be stolen from us.
• Kliwe is the name on your statement. Worth knowing in advance — an unfamiliar line on a bank statement is otherwise indistinguishable from fraud, and we would rather you did not have that ten minutes.
• Top-ups are screened, and so are new accounts. Expensive destinations are rate-limited until an account has a small amount of history. It is occasionally inconvenient for one honest person and it is the reason the published rates can stay where they are: stolen cards buying calls is what funds the fraud everybody else prices in.

What we keep about your calls

The call detail record: the number you dialled, when, for how long, what it cost and what your balance was afterwards. This is what billing requires and what the law requires of anyone carrying voice traffic, and we would not be able to show you an honest receipt without it.

What we do not keep is your voice. There is no audio and no analysis of how anything was said, because nothing is ever recorded. An account can switch on transcripts, in which case the words spoken on its own calls are written down as text, kept for a stated number of days and then deleted — off unless somebody turns it on, priced on the page that offers it, and deletable one at a time. You can see your history, export it, and delete what we are not legally obliged to retain — the privacy page states exactly what that is rather than implying it.

Your account

• One account, one balance, one owner. Nobody at Kliwe can place a call on your account or spend your balance.
• Sessions can be ended remotely. If you signed in on a borrowed or public computer and forgot to sign out, you can end that session from anywhere. This matters more here than on most products, since the entire premise is being able to use a machine that is not yours.
• Least privilege internally. Access to production is restricted to the people who operate it, granted individually, and revoked when it is no longer needed.

Reporting a vulnerability

Email security@kliwe.com with enough detail to reproduce the issue. You will get a human response — not an autoresponder — acknowledging the report.

We will not pursue legal action against anyone who reports a vulnerability in good faith, gives us reasonable time to fix it before disclosing, and does not access, modify or exfiltrate data belonging to anyone other than themselves. Testing against your own account and your own balance is always in scope.

Please do not run automated scanners against production, attempt denial of service, or use social engineering against our team or our customers. And specifically: please do not test by placing calls to real people or to emergency numbers. There is a person on the other end of every number on this network.

Availability

Live availability is published at status.kliwe.com, by region, with incident history. Voice is a service where a five-minute outage is a call somebody could not make at the only hour the office was open, and we report it accordingly rather than rounding it away in a monthly percentage.