STIR/SHAKEN
Signed calls.
Real callers.
A Dials outbound call carries a STIR/SHAKEN attestation that says, cryptographically, who is calling. Full A-level when the originator owns the number. We don't sign what we can't verify.
At a glance
What attestation levels mean.
A
Full
Originator authenticated and authorized to use the calling number.
B
Partial
Originator authenticated; number ownership not verified end-to-end.
C
Gateway
Call passed through a gateway; identity not authenticated.
None
Blocked
Unsigned calls fail the egress policy on Dials by default.
Sign by default
Every outbound,
every time.
When a seat dials, Dials looks up number ownership, mints a SHAKEN PASSporT, and signs the SIP INVITE. The signing layer is part of the egress path. There's no opt-out — only escalation.
- Per-call PASSporT
- Per-tenant SP-Code
- Hardware-isolated keys
- Per-call signing record
AttestationA · full
Originator+1 512 555 0199
Recipient+1 415 555 0144
SP-Code1234
Cert chainVerified · 30d valid
PASSporTeyJhbGciOiJFUzI1NiIs…
Trace and verify
Hand it to a regulator.
Hand it to the network.
The signed PASSporT, the SIP INVITE, the attestation level, the certificate chain, and the downstream acknowledgement all land on the record. Pull the trace by call ID and reproduce the signing decision.
- Per-call certificate chain
- Downstream acknowledgement
- Trace ID per call
- Exportable bundle
Egress signing
Signed · 14 ms
Trunk handoff
200 OK · trunk-east-01
Downstream acknowledgement
Identity-OK · A
Recipient network
Recv'd · A · displayed
Verify a signature.
Place an outbound call from the console and pull the trace. The PASSporT renders as JWT alongside the signing chain.