SECURITY
Keep your phone system secure
Practical advice for protecting your Topaz account, payments, SIP credentials and phones.
Payments
Card payments are taken on Stripe’s hosted checkout. You enter your card details on Stripe; they never touch Topaz.
Account access
Give each person their own Control panel login. Admins manage the whole account in the Control panel: users, phones, numbers, call routing and billing. Other users sign in to call from the Topaz Softphone and can change only their own profile and password. Give the Admin role only to people who manage the account. If you forget your password, use “Forgot password” on the Control panel login page.
SIP credentials
Each device has its own SIP username and password. Don’t share them in email, chat or screenshots. If one may have leaked, change it in the Control panel and update the phone.
Encryption
The Control panel and signup pages use HTTPS. Phones can encrypt their connection to Topaz: TLS (sip.topaz.tel, port 5061) protects sign-in and call setup, and SRTP protects the audio. Phones that use UDP or TCP on port 5060 are not encrypted. The Topaz Softphone always encrypts its calls. See Phones & devices for the settings.
Watch for unexpected calls
Check call history and your balance regularly. Because Topaz is prepaid, paid calls stop when your credit runs out, which limits what unexpected calling can cost.
Desk phones
Change the default admin password on desk phones, keep their firmware up to date, and don’t expose a phone’s web interface to the internet.