Trust, security & compliance.
How Dollu operates as a licensed carrier: the regulations we work under in each market, the security controls around the network and your data, how we detect fraud, how the platform stays up, and how to reach us when something needs attention.
ISO 27001
Aligned ISMS, status on request
24 × 7
NOC and security monitoring
90 days
Coordinated disclosure window
Compliance at a glance.
Frameworks and regulators that shape how we run the business, with the honest status of each. Certificates, licence numbers and audit reports are shared under NDA rather than published here.
- Information security management
ISO/IEC 27001
ISMS aligned to ISO 27001 controls; certification status available on request.
- Trust Services Criteria
SOC 2
Controls mapped to security, availability and confidentiality criteria; report status on request.
- EU and UK personal data
GDPR / UK GDPR
Processor and controller obligations met; DPA with SCCs and UK Addendum available.
- Indian personal data
India DPDP Act 2023
Privacy programme aligned to DPDP principles; consent, notice and grievance processes in place.
- India telecom services
DoT / TRAI
Operates under applicable Indian licences and registrations; details under NDA.
- TRAI TCCCPR
DLT (India A2P SMS)
A2P SMS to India delivered over DLT-scrubbed routes; entity, header and template registration supported.
- United Kingdom
Ofcom
UK services provided in accordance with the General Conditions of Entitlement; details on request.
- United States voice
FCC / STIR/SHAKEN
US-bound calls signed and attested; Robocall Mitigation Database status on request.
- United States messaging
10DLC / TCPA
Brand and campaign registration supported; consent and opt-out controls enforced by the AUP.
- Card payments
PCI DSS
Card data is handled by PCI DSS-compliant payment providers; Dollu does not store card numbers.
- EU and UK electronic marketing
PECR / ePrivacy
Consent, sender identification and opt-out rules for marketing messages enforced through the AUP and SMS firewall.
- Customer and partner screening
Sanctions and export controls
Customers and carrier partners screened against applicable sanctions lists at onboarding and periodically.
Licensed where we operate, partnered where we are not.
Telecom is regulated market by market. We hold or work under the licences and registrations each service requires, and we keep the paperwork ready for due diligence.
India - DoT, TRAI and DLT
Voice, numbering and messaging services in India are provided under the applicable Department of Telecommunications licences and TRAI regulations, including DLT registration for A2P SMS and KYC for number allocation. Licence copies are shared under NDA.
United Kingdom - Ofcom
UK numbers, SIP trunking and messaging are delivered in line with Ofcom General Conditions, the numbering plan and CLI guidance, with number-porting obligations honoured through our UK interconnect partners.
United States - FCC, STIR/SHAKEN, 10DLC
US voice traffic is signed and attested under STIR/SHAKEN, robocall-mitigation practices are documented, and A2P messaging follows CTIA guidelines with 10DLC brand and campaign registration and TCPA-aware consent controls.
European Union - GDPR and national NRAs
EU numbering and traffic are handled through our Frankfurt and Amsterdam PoPs and licensed local partners, with GDPR-compliant processing, ePrivacy-aware messaging rules and national numbering conditions applied per country.
Other markets - licensed local partners
In countries where Dollu is not itself licensed, services are provided through licensed local operators under written agreements. Country-specific KYC, address-proof and usage restrictions are published on each coverage page.
Documentation under NDA
Licence numbers, registration certificates and regulator correspondence are provided to customers and partners under NDA during due diligence, together with the compliance contact for each market.
Controls built around a carrier network.
An information security management system aligned to ISO/IEC 27001, applied to switches, SBCs, SMSCs, APIs, portal and the corporate estate alike.
ISO 27001-aligned ISMS
Documented policies, risk register, asset inventory, statement of applicability and management review cycle aligned to ISO/IEC 27001 Annex A. Ownership sits with a named security lead reporting to the executive team.
Access control
Role-based access to switches, SBCs, SMSCs, portal and billing systems; MFA for all administrative and portal accounts; joiner-mover-leaver reviews; privileged access via bastion hosts with session logging.
Encryption in transit
TLS 1.2+ for portal, APIs and SMPP-over-TLS; SIP over TLS with SRTP media on request; IPsec or private interconnect for carrier and enterprise links; HSTS and modern cipher suites on public endpoints.
Encryption at rest
Customer, KYC and CDR stores encrypted at rest with managed keys; backups encrypted and stored in a separate region; secrets held in a vault, never in code or tickets.
Logging and monitoring
Centralised logs from network, platform and application tiers with retention aligned to the privacy policy; alerting on authentication anomalies, configuration changes and traffic patterns, watched 24×7 by the NOC.
Vulnerability management
Continuous dependency and host scanning, defined patch SLAs by severity, and hardening baselines for network and server builds. Findings are tracked to closure in the risk register.
Penetration testing
Independent penetration tests of the portal, public APIs and SIP/SMPP edges on a recurring cycle and after major changes. Executive summaries are shared with customers under NDA.
Secure development
Peer review, branch protection, automated tests and dependency checks in the release pipeline; separation between development, staging and production; change management with rollback plans.
People and suppliers
Background checks where lawful, confidentiality agreements, annual security awareness training, and supplier assessments before onboarding any sub-processor or carrier with system access.
Data protection, residency and retention.
Where data lives, how long CDRs are kept and which agreements govern processing. Full detail is in the Privacy Policy and the DPA.
| Roles | Controller for website, account and billing data; processor for end-user data customers route across the network, or independent controller where telecom law requires (routing, interconnect billing, fraud prevention, lawful requests). |
|---|---|
| Legal frameworks | GDPR and UK GDPR, India Digital Personal Data Protection Act 2023, applicable US state privacy laws, and telecom-specific retention and lawful-intercept duties in each market. |
| Data residency regions | India (Noida, Mumbai), EU (Frankfurt, Amsterdam), UK (London), US (Ashburn), APAC (Singapore). Account data is stored in India with regional replicas; traffic data is processed where the session is handled. India-only, EU-only or US-only configurations available on request. |
| CDR retention | CDRs, delivery receipts and SIP metadata retained 12 to 24 months for billing and disputes, extended where a licence or regulator requires. Message content and voice media are not retained beyond delivery unless the customer enables recording or storage. |
| Data Processing Addendum | Standard DPA incorporating Standard Contractual Clauses and the UK International Data Transfer Addendum, available on request. Customer-paper DPAs reviewed for enterprise agreements. |
| Data subject requests | Handled by [email protected] within one month (45 days for CCPA). End-user requests are redirected to the customer as controller where appropriate. |
| Breach notification | Customers notified without undue delay of personal-data breaches likely to affect them, within GDPR, DPDP and applicable US timeframes, with the information needed for their own regulatory notifications. |
| Privacy documents | Privacy Policy and Cookie Policy published under /legal; DPA, sub-processor list and transfer impact assessment summary provided on request. |
Fraud controls that protect you and the routes.
Wholesale voice and A2P messaging attract fraud. Detection runs in real time on the platform and is backed by KYC, contractual rules and 24×7 human oversight.
IRSF and Wangiri detection
Real-time velocity, destination and cost thresholds on every trunk, hot-list blocking of known revenue-share ranges, short-duration and callback pattern detection, and automatic trunk suspension with NOC notification.
SMS firewall
Content, sender-ID and volume rules on A2P routes, grey-route and SIM-farm detection, spoofed-sender blocking and per-destination compliance filters, so operator partners see clean traffic and delivery rates stay high.
KYC for numbers and accounts
Identity, business and address verification before numbers are allocated, matched to each country's regulator requirements; enhanced due diligence for toll-free, mobile and short-code allocations.
Acceptable Use Policy
Published rules covering consent, opt-out, prohibited content, traffic pumping and grey routes, enforced with warnings, filtering, suspension and termination as set out in the AUP.
Spend and credit controls
Per-account and per-trunk spend caps, destination allow-lists, and prepaid or credit-limit enforcement to contain the impact of a compromised PBX or API key.
Sanctions and reputation screening
Customers and carrier partners screened against applicable sanctions lists at onboarding and periodically; number reputation and CLI validation applied to inbound and outbound traffic.
Engineered to stay up, and to recover fast.
Geo-redundant architecture, a 24×7 NOC and rehearsed recovery plans. Live website and API health is on the status page.
| Core architecture | Dual-homed switching in Noida and Mumbai with geo-redundant SIP, SMPP and API edges in London, Frankfurt, Amsterdam, Ashburn and Singapore. Active-active pairs; failover is automatic and tested. |
|---|---|
| Availability target | 99.99% core platform availability, with per-service targets and credits defined in the SLA. |
| Operations | 24×7 engineer-staffed NOC, P1 response within 15 minutes, published escalation matrix and post-incident reports within 5 business days. |
| Disaster recovery | Documented DR plan per platform with defined RTO and RPO targets, encrypted cross-region backups, and at least annual restore and failover exercises. Target values are shared with customers on request. |
| Maintenance policy | Planned works notified at least 5 business days ahead; standard windows 22:00-04:00 local PoP time; emergency maintenance notified as early as possible with impact and back-out plan. |
| Capacity | 1.4 Tbps backbone across 40+ PoPs, diverse carrier interconnects and upstream transit, capacity reviewed monthly and upgraded ahead of committed growth. |
| Business continuity | NOC able to operate from an alternate location, tested communications tree, supplier and carrier fallback routes, and a business continuity plan reviewed at least annually. |
Who else touches your data.
We use a small number of sub-processors in the categories below. The named list, with locations and functions, is available from [email protected]; DPA customers receive 30 days' notice of material changes.
Cloud and hosting
Infrastructure providers hosting platform components, backups and cloud regions in India, EU, UK, US and APAC.
Carrier and interconnect partners
Tier-1 and domestic operators that carry voice, deliver SMS and provide numbering in each destination.
Payments and billing
PCI DSS-compliant payment processors and invoicing tools; card data never touches Dollu systems.
Support, CRM and ticketing
Customer relationship and helpdesk systems used to run sales, onboarding and the NOC ticket queue.
Email and notifications
Transactional email and notification delivery for portal alerts, maintenance notices and incident updates.
Monitoring and security tooling
Logging, monitoring, vulnerability scanning and fraud-detection services that process limited traffic metadata.
Found a security issue? Tell us.
We welcome good-faith security research on our public systems and commit to working with researchers openly and promptly.
Report to
[email protected]Machine-readable contact details are published at /.well-known/security.txt. A PGP key is available on request.
Coordinated disclosure timeline
- 01We acknowledge your report within two business days and assign a tracking reference.
- 02We validate the issue, agree severity with you and keep you informed of remediation progress.
- 03We aim to remediate within 90 days of the report. If we need longer, we will explain why and agree a revised date.
- 04After remediation, or after 90 days, you may publish your findings. We are happy to credit you if you wish.
Safe harbour
If you make a good-faith effort to comply with this policy, Dollu will not pursue or support legal action against you for your research, and we will not report you to law enforcement for it. Good faith means: only testing systems owned by Dollu, avoiding privacy violations, service degradation and data destruction, not accessing or modifying data beyond what is needed to demonstrate the issue, not exploiting a finding for gain, and giving us reasonable time to fix it before disclosure. Social engineering, physical intrusion, denial-of-service and testing of third-party carriers or customers are out of scope.
What to include
- Affected host, endpoint or component
- Steps to reproduce, requests and responses
- Your assessment of impact and severity
- Proof-of-concept where safe to share
- Whether you want public credit
- How to reach you for questions
Available on request.
For procurement, security reviews and carrier due diligence. Tell us which documents you need and, where required, we will send an NDA first.
Statement of Applicability
ISO 27001 Annex A control mapping and policy index
Penetration test summary
Latest executive summary and remediation status
Data Processing Addendum
With SCCs and UK Addendum; customer paper reviewed
Sub-processor list
Names, locations and functions; 30-day change notice
Licence and registration copies
Per market, shared under NDA during due diligence
Insurance certificates
Certificates of insurance for the cover currently held
Business continuity summary
DR/BCP scope, RTO and RPO targets, last test date
Security questionnaire
Completed CAIQ / SIG-style questionnaire or your own template
Trust and compliance - common questions.
What procurement, security and legal teams ask before signing. If your question is not here, our team answers within one business day.
Still have a question?
Ask our solutions teamNeed our security pack?
Send us your questionnaire or tell us which documents you need. We return a completed pack, an NDA where required and a named contact for follow-up questions.
