By Sagar Shankaran, Founder of CallSphere
TLS 1.3, AES-256, and KMS-backed key management — what defaults ship with CallSphere vs the patchwork you assemble for Vapi.
Key takeaways
Encryption is now table-stakes for any compliance posture: HIPAA Security Rule technical safeguards CC6.7 and CC6.8, GDPR Art. 32, PCI-DSS 4.0. The defaults matter — auditors examine "what ships out of the box" because customer drift from defaults is a common audit finding. CallSphere ships with TLS 1.3 in transit, AES-256 at rest, KMS-backed keys, and per-tenant database isolation. Vapi.ai's encryption posture is the union of what each upstream vendor (STT, LLM, TTS, telephony) and the customer's own glue code happen to enable. This post shows the encryption layer model, where each platform fits, and what to ask in procurement.
Most security failures come from misconfiguration, not algorithm weakness. AES-256 has been NIST-approved for 25+ years; the breaches happen because:
A platform with strong defaults removes most of these risks before a customer engineer can introduce them. A platform with per-component customer-configured encryption maximizes them.
A voice AI call has at least seven encryption-relevant layers:
Plus admin / dashboard / API access (HTTPS), database connections (TLS), backup encryption, and key management.
| Layer | Default |
|---|---|
| Caller→carrier (Twilio) | SRTP / SIP-TLS |
| Carrier→CallSphere | TLS 1.3 |
| Internal service-to-service | TLS within K8s service mesh |
| LLM provider | TLS 1.3 |
| Database connections | TLS 1.3 (Postgres SSL required) |
| Storage at rest | AES-256 (S3 SSE or RDS encryption) |
| Backup encryption | AES-256 |
| Dashboard access | TLS 1.3 + JWT |
| Admin API | TLS 1.3 + JWT + RBAC |
| Key management | AWS KMS / equivalent regional KMS |
| Cipher suites | Modern only (no SHA-1, no RC4, no 3DES) |
These are not toggles — they are the only enabled options.
Vapi customers must verify encryption per layer per vendor, and may discover:
The customer's audit obligation is to verify and document each of these. Misses become findings.
graph TB
CALLER[Caller Phone] -->|SRTP/SIP-TLS| TWILIO[Twilio Carrier]
TWILIO -->|TLS 1.3| CSP[CallSphere Edge]
CSP -->|mTLS| AGENT[Voice Agent Service]
AGENT -->|TLS 1.3| STT[STT Provider]
AGENT -->|TLS 1.3| LLM[LLM Provider]
AGENT -->|TLS 1.3| TTS[TTS Provider]
AGENT -->|SSL| DB[(Postgres TLS)]
DB -. AES-256 SSE.- KMS[AWS KMS]
AGENT -->|HTTPS+JWT| DASH[Dashboard]
DASH -->|RBAC| OPS[Ops User]
AGENT -. AES-256.-> S3[(S3 Recordings)]
S3 -. SSE-KMS.- KMSEvery edge in the diagram is encrypted, and the keys for at-rest data are KMS-managed.
| Encryption Capability | Vapi DIY | CallSphere |
|---|---|---|
| TLS 1.3 enforced everywhere | Per-vendor verify | Default |
| AES-256 at rest | Per-vendor verify | Default |
| Customer-managed keys (CMK) | Per-vendor | Available via KMS |
| Database TLS required | Customer-configured | Required |
| Backup encryption | Customer-configured | Default |
| Cipher hardening | Per-vendor | Default modern-only |
| Key rotation policy | Per-vendor | Documented |
| Cross-component mTLS | Build yourself | Available |
| FIPS 140-2 endpoints | Per-vendor | Available on request |
| Audit log encryption | Per-vendor | Default |
CallSphere uses AWS KMS (and regional equivalents) for at-rest encryption keys. CMKs can be customer-owned for enterprise customers. Key access is logged via AWS CloudTrail, satisfying the "encryption logging" controls in HIPAA.
In a Vapi-based stack, each upstream vendor brings its own key management. Reconciling these into a single audit narrative is non-trivial — and a misconfigured S3 bucket on the customer's side is a classic finding.
A 2025 audit of a healthcare technology company using a Vapi-style multi-vendor stack found:
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
Two findings led to qualified opinions. Remediation took 4 months. CallSphere's defaults would have prevented all three.
Encryption is the easiest control to get wrong by accident. Book a CallSphere demo and ask for our encryption-defaults summary. Or visit our pricing for plan tiers.
Yes. Enterprise plans support CMK via AWS KMS, with documented key access auditing.
FIPS 140-2 validated endpoints are available on request for federal and state government workloads.
By default they share a per-tenant master key, with separate data keys per object envelope-encrypted. Enterprise customers can use distinct CMKs per data class.
Yes — internal service-to-service traffic in CallSphere's K8s mesh uses mTLS where supported, with strict cipher suites.
CallSphere runs continuous TLS configuration scans (Mozilla Observatory / SSL Labs equivalents) on customer-facing endpoints, with results reviewed monthly.
Modern TLS deployments benefit from explicit cipher suite restrictions, not just version restrictions. CallSphere's TLS termination points enforce:
TLS 1.3 cipher suites (allowed):
TLS 1.2 cipher suites (allowed for legacy carrier interop only):
Disabled across the board:
This list passes Mozilla's "Modern" recommendation as well as PCI-DSS 4.0 cipher requirements.
Documented rotation cadence at CallSphere:
| Key Type | Cadence | Method |
|---|---|---|
| TLS certificates | 90 days | Automated via ACM / Let's Encrypt |
| Database encryption master key | Annual (or on personnel change) | KMS-managed |
| Application JWT signing key | Quarterly | Automated rollover with grace period |
| API keys (customer) | Customer-controlled | Self-service rotation |
| KMS data keys | Per-object envelope | AWS KMS-managed |
| SSH keys (operator access) | 90 days | Centralized key management |
| Backup encryption keys | Annual | Managed alongside DB keys |
A single piece of customer data may be encrypted at multiple layers:
The layered design means a single layer compromise does not expose plaintext.
NIST published the first post-quantum cryptography standards in 2024, and major TLS implementations are adding hybrid PQC support. CallSphere's roadmap includes:
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
Vapi-based stacks will require each upstream vendor to migrate independently, with no coordination guarantee.
For customers requiring "encryption in use" (data encrypted while being processed), CallSphere is evaluating AWS Nitro Enclaves and confidential compute options for the most sensitive workflows. This goes beyond standard encryption-at-rest and in-transit and is typically required only by very high-sensitivity customers (federal, financial, or biotech).
CallSphere publishes an encryption posture document covering:
This document is updated quarterly and is included in the trust portal.
In a 2025 supply chain incident (industry-wide, not CallSphere-specific), a vulnerability in a popular TLS termination component allowed downgrade attacks on older deployments. CallSphere customers were unaffected because:
Customers running multi-vendor stacks reported much longer remediation timelines because each vendor had to be patched independently.
Trace a single call through encryption layers:
Twelve encryption events per call. Each one is enforced by default. A misconfigured layer would be caught in CI / continuous monitoring.
Encryption defaults map to:
A single encryption posture document can be mapped to all of these for the auditor.
When a customer requests erasure, CallSphere can use cryptographic shredding:
After the KMS key is destroyed, even if the encrypted bytes were exfiltrated, they are unrecoverable. This is faster and more defensible than physically scrubbing every storage layer.
A common concern: does strong encryption slow voice down? In practice:
Total per-call encryption latency: ~20-50ms, well within real-time voice budgets. Modern hardware (AES-NI instructions on Intel / AMD CPUs) makes encryption essentially free at voice volumes.
Encryption controls produce evidence including:
This evidence is auditor-ready and exportable from the trust portal.
When evaluating any voice AI vendor, watch for these red flags:
CallSphere's CI / continuous compliance monitoring catches all of these before they reach production.
Written by
Sagar Shankaran· Founder, CallSphere
LinkedInSagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
CallSphere ships multi-tenant practices natively. Deploying 50 clinics on Vapi means 50 manual setups or building a multi-tenant layer. The cost breakdown.
Tenants, leases, rent ledger, maintenance — all built into CallSphere Real Estate. On Vapi, build it yourself. Full tenant lifecycle breakdown.
CallSphere's Mortgage Calculator agent runs affordability, repayment, and live bank rate scenarios. Vapi has no built-in financial agent. Here is the path.
CallSphere's Suburb Intelligence agent fuses schools, demographics, commute, and forecasts in real time. On Vapi, you build all of it. The data engineering breakdown.
How long should you keep call recordings? CallSphere ships per-vertical retention defaults; Vapi customers DIY. Compare lifecycle and erasure flows.
A caller texts a property photo mid-call. CallSphere analyzes it and integrates the answer into the voice flow. Vapi has no native vision. Here is how it works.
© 2026 CallSphere Inc. All rights reserved.
Made within San Francisco
Watch how CallSphere handles real customer calls, schedules appointments, and processes payments — live.
Try Live DemoBook a DemoCalculate Your ROI