Security
A softphone sits in the middle of every conversation your business has. Here is exactly what Meow does with them, and what it keeps.
Where your calls go
Calls never reach us
Meow registers directly with your PBX or SIP provider. Signalling and audio go between your machine and your infrastructure. We operate no media relay, no SBC and no proxy, so there is nothing of yours passing through our systems to intercept, log or subpoena.
Encrypted transport when your PBX offers it
Accounts can register over UDP, TCP or TLS. Media is encrypted with SRTP whenever the far end negotiates it, and falls back to unencrypted rather than dropping the call. The call screen always states which you got, so the answer is never a guess.
NAT handled without opening your firewall
Meow keeps its own registration alive so the PBX can reach it, and corrects the common misconfiguration where a PBX advertises a private media address. No inbound port forwarding is required on the client side.
What is on your machine
AES-256-GCM for credentials
SIP passwords are encrypted with AES-256-GCM using a key derived from the application data directory. GCM is authenticated encryption, so tampering with the stored value makes it fail to decrypt rather than silently return something else. Profiles written by older versions used AES-256-CBC and are migrated on read.
Everything else is a local database
Contacts, call history and recordings live in SQLite under your user account. There is no cloud sync, no server-side copy and no account with us holding your configuration. Deleting the data directory removes all of it.
Recordings stay where they are made
Call recordings are written to your own disk and listed in the app. They are never uploaded. Recording is manual per call, or automatic if you switch it on, and local law usually requires telling the other party.
Licence integrity
Ed25519 signed licence tokens
A licence token is signed by our server and verified against an embedded public key on every start. A token that does not verify is refused, so an edited or transplanted licence cannot be made to work by changing the database.
The database is not trusted on its own
The cached expiry date is validated against the signed payload rather than read at face value, so moving a clock or editing a row does not extend a licence.
Clock drift is rejected
Server responses carry a timestamp. If your machine's clock disagrees with ours by more than a few minutes the response is rejected, which closes the obvious way to replay an expired token.
Signed requests, and proof of work
Each device registers an Ed25519 key and signs its requests with it, so licence traffic cannot be trivially forged. Registration also requires a SHA-256 proof of work, which makes automated abuse expensive without asking anything of a real user.
Everything that leaves your machine
This is the complete list. If it is not here, Meow does not send it.
| What | When | Contains |
|---|---|---|
| Licence check | Start-up, then periodically | Licence key and a hashed hardware fingerprint |
| Update check | Start-up | Application version and operating system |
| Anonymous usage data | Start-up, if left enabled | Operating system, version, anonymous device ID |
Meow asks about usage data on first run, with the switch on. Turning it off there, or later under Settings → Privacy, stops it. No call audio, no numbers, no contacts and no message content is sent under any setting.
Honest limits
- SRTP depends on your PBX. Meow offers it on every call, but a server that declines gets an unencrypted one rather than a failed one. The call screen tells you which happened, every time.
- Local encryption protects a stolen file, not a compromised account. The key lives in your user profile. Anyone who can already run code as you can read what you can read.
- Recordings are plain audio files. They are not encrypted on disk. Treat the recordings folder the way you would treat any other sensitive directory.
Reporting a problem
If you believe you have found a security issue, please get in touch with the details rather than posting them publicly, and we will come back to you. For how we handle personal data, see the Privacy Policy. For how the pieces fit together, see the technical details.