HIPAA-ready
Business Associate Agreement on request. Patient-data-grade voice and messaging for healthcare partners and the platforms that serve them.
BAA available
TKOS runs a carrier-grade voice and messaging stack with HIPAA BAA on request, POPIA compliance overseen from Johannesburg, STIR/SHAKEN attestation on US-bound traffic, and AES-256 at rest with TLS 1.3 in transit. The controls below are the ones our healthcare and financial-services partners audit before signing.
Four independently audited regimes, one stack. Our healthcare clients rely on the HIPAA BAA, our SA enterprise customers anchor on POPIA, and US-bound traffic is signed against the FCC STIR/SHAKEN framework.
Business Associate Agreement on request. Patient-data-grade voice and messaging for healthcare partners and the platforms that serve them.
Data minimisation, lawful basis, breach reporting and subject-access workflows mapped to South Africa's POPI Act and overseen from our Johannesburg HQ.
Carrier-signed full A-level attestation on US-bound traffic. Calls without proper attestation are flagged by US carriers — yours arrive verified.
Information-security management system being formalised against ISO 27001. Controls already operate against the same Annex A baseline — certification scheduled.
Every byte that touches the TKOS network is encrypted in transit and at rest. Customers on the enterprise contact-center tier can bring their own KMS keys so the cleartext never leaves their boundary — TKOS holds the ciphertext, you hold the keys.
AES-256 at rest
Recordings, voicemails, CDRs, audit logs — every storage tier.
TLS 1.3 in transit
SIPS + SRTP for media; HTTPS with HSTS for the control plane.
Customer-managed keys
Bring-your-own KMS on enterprise tier with key rotation hooks.
The same controls your security team would build internally — already wired into the platform. RBAC scopes the surface, SSO centralises identity, and every action — from a receptionist call route change to a DID re-assignment — ends up in an audit log your auditors can pull in CSV or push to your SIEM.
Granular permissions across phone, contact-centre, billing and DID inventory. Roles inherit from groups, groups from policies, and every change is audited.
SAML 2.0 with Okta, Azure AD, Google Workspace and any compliant IdP. SCIM provisioning, just-in-time user creation, and enforced MFA at the IdP layer.
Every admin action and call event lands in an append-only audit log, exportable as CSV or streamed via webhook to your SIEM for long-term retention.
All customer data lands first in our Johannesburg primary region, the same site that hosts the NOC. An encrypted Europe mirror provides disaster recovery and serves cross-border partners that need an EU-resident copy on file. Enterprise customers can pin residency to a single region at contract signing.
Straight answers on BAAs, residency, retention, audit log export, and incident response — the five questions every vendor review surfaces.
Move to the platform that signs the BAA, attests every US call, and hands you the audit log on day one — without a six-month security review.