Security and assurance

1. Establish the security scope

Security depends on the selected deployment and support arrangement. Agree who operates the infrastructure, manages identities and endpoint devices, configures the PBX, controls provider accounts and maintains recovery arrangements. Customer-operated, private-cloud and managed services do not automatically share the same control scope.

2. Standards and certification

ISO/IEC 27001:2022 defines requirements for an information security management system. ISO/IEC 27701:2025 defines requirements and guidance for privacy information management. They are useful assessment frameworks, but publishing a policy does not establish conformity or certification.

This page makes no claim that Telfron is certified to either standard. Any certification claim must be supported by the certified legal entity, current certificate, certification body, validity period and covered scope. Product capability, organizational certification and a customer’s regulatory compliance are different matters.

3. Controls to verify for your deployment

• Access: administrative roles, account lifecycle, authentication, privilege review and tenant boundaries.
• Protection: transport settings, certificate management, storage protection and sensitive-data handling.
• Operations: patch responsibilities, configuration changes, logging, monitoring and endpoint support.
• Recovery: backup scope, restore testing, dependencies and agreed recovery objectives.
• Suppliers: approved integrations, AI processing, access limits and international data locations.

4. Incidents and vulnerability reporting

Send suspected security issues to info@telfron.com with the subject ‘Security report’. Describe the affected service, timing and a minimal reproduction. Do not include unnecessary personal information, active credentials or large data extracts. Receiving a report does not authorize further testing; request explicit permission before testing beyond ordinary use.

Agree a secure reporting channel before sharing sensitive evidence. Incident contacts, processor-notification obligations and response commitments should be specified for the relevant service. No bug-bounty reward, legal safe-harbor promise or guaranteed response time is created by this page.

5. Evidence and customer assessment

Request deployment-specific documentation before relying on a security claim. Relevant evidence may include control descriptions, approved supplier details, testing results, processing terms and any current independently verified certificate. Availability and disclosure of material depend on the service, confidentiality and authorization.

Evaluate applicable privacy, telecommunications, recording, employment and sector rules in the countries where the service is used. No single ISO standard or policy page guarantees compliance with every law worldwide.